Vulnerability · Published Jan 21, 2026 · Assigned by VulnCheck
CVE-2021-47802Tenda D151 & D301 - Configuration Download
High 7.5
In plain English
A high-severity missing authentication in Tenda D151 & D301 from Shenzhen Tenda Technology Co.,Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Tenda Technology Co.,Ltd. | Tenda D151 & D301 | - |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-49782 exploit
- Tenda Official Vendor Homepage product
- VulnCheck Advisory: Tenda D151 & D301 - Configuration Download third-party-advisory