CVE-2024-46430

Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated remote attacker to change the administrator password by sending a specially crafted HTTP POST request to the setLoginPassword function, bypassing the authentication mechanism.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2025-02-10

Last modified

2025-02-10

Weaknesses

CWE-284

Affected products

• W18e Firmware (Tenda)

References

• https://reddassolutions.com/blog/tenda_w18e_security_research