CVE-2024-46434

{"id": "CVE-2024-46434", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-02-10T19:15:38.803", "references": [{"url": "https://reddassolutions.com/blog/tenda_w18e_security_research", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative access by sending a specially crafted HTTP request."}, {"lang": "es", "value": "Tenda W18E V16.01.0.8(1625) sufre una evasi\u00f3n de autenticaci\u00f3n en el portal de administraci\u00f3n web, lo que permite que un atacante remoto no autorizado obtenga acceso administrativo mediante el env\u00edo de una solicitud HTTP especialmente manipulada."}], "lastModified": "2025-03-25T18:13:15.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tenda:w18e_firmware:16.01.0.8\\(1625\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82DCF7DC-C017-47D7-88FF-D50172639280"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tenda:w18e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "169334F3-1B6E-4A8A-99E5-2B4B98D92BE0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}