cbcvebase.
CVE-2020-35391
published 2021-01-01

CVE-2020-35391: Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for…

PriorityP276medium6.5CVSS 3.1
AVAACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
35.00%
98.3th percentile
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.

Affected

1 ranges
VendorProductVersion rangeFixed in
tendaf3_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/DownloadCfg/RouterCfm.cfg↗
pathcgi-bin/DownloadCfg/RouterCfm.cfg↗
otherfavicon_hash:-2145085239↗
filenameRouterCfm.cfg↗
  • →Detect unauthenticated GET requests to the sensitive config download path; the exploit uses a stripped User-Agent and empty Accept/Host headers as the malformed request technique. ↗
  • →Alert on HTTP responses containing 'http_passwd=' in the body, which indicates successful credential exfiltration from the config file. ↗
  • →Use Shodan favicon hash -2145085239 combined with title 'Tenda | LOGIN' to identify exposed vulnerable Tenda N300 F3 devices on the internet. ↗
  • →The exploit fingerprints the target by fetching /favicon.ico and computing its mmh3 hash; a hash value of -2145085239 confirms a Tenda device. ↗
  • ·The NVD advisory notes uncertainty about whether a trailing '?' after the filename or unusual HTTP headers are strictly required to trigger the vulnerability — the exact triggering condition is unconfirmed. ↗
  • ·The exploit was confirmed on F3v3.0 firmware but the author lists the affected version as 'All', meaning other firmware revisions may also be vulnerable. ↗

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:P/I:N/A:N
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.