CVE-2026-24427mediumCWE-201

CVE-2026-24427: falha de média gravidade em Shenzhen Tenda Technology Co., Ltd. Tenda AC7

Tenda AC7 Exposes Admin Credentials in Configuration Responses

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Tenda AC7

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.1%
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including the router and/or admin panel password, are included in plaintext within configuration response bodies. In addition, responses lack appropriate Cache-Control directives, which may permit web browsers to cache pages containing these credentials and enable subsequent disclosure to an attacker with access to the client system or browser profile.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Shenzhen Tenda Technology Co., Ltd. · Tenda AC7
CVEs relacionadas — Shenzhen Tenda Technology Co., Ltd. Tenda AC7

No mesmo produto, das mais perigosas para as menos.

CVE-2026-24441HIGHTenda AC7 Transmits Admin Credentials Without HTTPS ProtectionEPSS 0.2%CVE-2026-24426MEDIUMTenda AC7 Reflected XSS via Web Interface Output EncodingEPSS 0.2%CVE-2026-24434MEDIUMTenda AC7 Web Interface Lacks CSRF Protections for Admin ActionsEPSS 0.2%