CVE-2021-47802

Published: Jan 21, 2026

Modified: Jan 22, 2026

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.

Vendor	Product	Versions
Shenzhen Tenda Technology Co.,Ltd.	Tenda D151 & D301	affected `-`

Weaknesses (CWE)

CWE-306

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

References

ExploitDB-49782

exploit

Tenda Official Vendor Homepage

product

VulnCheck Advisory: Tenda D151 & D301 - Configuration Download

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-47802

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References