Read the docs
TI-2020-17965 Aliases CVE-2020-35391GHSA-mfx7-787g-3rp3

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information…

Priority HIGH 67CWE-425Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-425.

Summary

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.

Why it matters now

EPSS 0.35248 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tenda:f3_firmware:12.01.01.48:*:*:*:*:*:*:*12.01.01.48VulnerableTenda
cpe:2.3:h:tenda:f3:-:*:*:*:*:*:*:*not specified by NVDRunning onTenda
  • cpe:2.3:o:tenda:f3_firmware:12.01.01.48:*:*:*:*:*:*:* Versions 12.01.01.48 Vulnerable ·Tenda
  • cpe:2.3:h:tenda:f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Tenda

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35391
  2. 2026-10-03 Alias added: GHSA-mfx7-787g-3rp3

References

Other 2

  • TI-2025-35571 Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the… CVSS 3.1MEDIUM 5.6
  • TI-2025-35570 Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList… CVSS 3.1MEDIUM 5.6
  • TI-2025-35569 Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. CVSS 3.1MEDIUM 5.6
  • TI-2025-35568 Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS. CVSS 3.1MEDIUM 5.6
  • TI-2025-35567 Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT. CVSS 3.1MEDIUM 5.6
  • TI-2026-21918 Tenda F3 Plaintext Credential Exposure in Configuration Download CVSS 4.0HIGH 7.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences