CVE-2022-40843
published 2022-11-15CVE-2022-40843: The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to…
PriorityP273medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
28.80%
97.9th percentile
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | w15e_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP GET request to /goform/downloadSyslog/syslog.log with an empty W15Ev2_user cookie value bypasses authentication on Tenda AC1200 V-W15Ev2 routers. ↗
- →A successful exploit returns HTTP 200 with Content-type: config/conf header and body containing keywords such as [system], [error], or [wan1]. ↗
- →Response body matching regex '^0\d{3}$' combined with syslog keywords ([system], [error], [wan1]) confirms successful authentication bypass and syslog file retrieval. ↗
- →The leaked syslog.log file contains the MD5 hash of the Administrator password; presence of this file in HTTP responses indicates active exploitation. ↗
- ·Vulnerability affects a specific firmware version; confirm target is running V15.11.0.10(1576) before applying detections. ↗
- ·The vulnerability is exploitable both on the local network and via the hosted remote management console, so detections should cover both internal and external-facing interfaces. ↗
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
vulncheck4.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-25jx-22x6-2cx2: The Tenda AC1200 V-W15Ev2 V15
ghsa_unreviewed·2022-11-15
CVE-2022-40843 [MEDIUM] CWE-863 GHSA-25jx-22x6-2cx2: The Tenda AC1200 V-W15Ev2 V15
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.
VulnCheck
Tenda w15e_firmware Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2022·CVSS 4.9
CVE-2022-40843 [MEDIUM] Tenda w15e_firmware Exposure of Sensitive Information to an Unauthorized Actor
Tenda w15e_firmware Exposure of Sensitive Information to an Unauthorized Actor
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.
Affected: Tenda w15e_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-05&host_type=src&vulnerability=cve-2022-40843; https://dashboard.shadowserver.org/stati
No detection rules found.
Nuclei
Tenda AC1200 V-W15Ev2 - Authentication Bypass
nuclei·CVSS 4.9
CVE-2022-40843 [MEDIUM] Tenda AC1200 V-W15Ev2 - Authentication Bypass
Tenda AC1200 V-W15Ev2 - Authentication Bypass
The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The improper validation of user sessions/authorization can lead to unauthenticated attackers having the ability to read the router's file, which contains the MD5 password of the Administrator's user account. This vulnerability exists within the local web and hosted remote management console.
Template:
id: CVE-2022-40843
info:
name: Tenda AC1200 V-W15Ev2 - Authentication Bypass
author: gy741
severity: medium
description: |
The Tenda AC1200 V-W15Ev2 router
No writeups or analysis indexed.
2022-11-15
Published
Exploited in the wild