CVE-2021-47802

8.7 highEPSS 0.7%

High (8.7) in tenda. EPSS 0.7% chance of exploitation in the next 30 days.

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tenda:d151_firmware
tenda:d301_firmware

References

https://www.exploit-db.com/exploits/49782
https://www.tendacn.com/us/
https://www.vulncheck.com/advisories/tenda-d-d-configuration-download

Check your stack JSON