CVE-2022-37176

Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into…

published August 30, 2022

CVSS
—
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

⚠️ A crafty packet is all it takes to strip your Wi-Fi security! The Tenda AC6 firmware allows attackers to blast open the door to your network without a password. 🔥 Think of it like a restaurant that decides to stop checking IDs at the door — anyone can walk in and start using the Wi-Fi, and suddenly, all your sensitive data is up for grabs! An attacker could remove the Wi-Fi password, leaving your network completely exposed. This means uninvited guests could easily connect and potentially snoop on your personal data or use your internet for nefarious purposes.

Put simply

Think of it like a restaurant that decides to stop checking IDs at the door — anyone can walk in and start using the Wi-Fi, and suddenly, all your sensitive data is up for grabs! This vulnerability allows attackers to send a specially crafted packet to the `goform/setWizard` endpoint, which can remove the Wi-Fi password and switch the router to an open security mode.

What to do

An attacker could remove the Wi-Fi password, leaving your network completely exposed. This means uninvited guests could easily connect and potentially snoop on your personal data or use your internet for nefarious purposes. To protect yourself, update the Tenda AC6 firmware to the latest version immediately. Change your passwords regularly and consider enabling additional security measures like MAC address filtering. 🛡️ You've got this! Take these steps, and your network will be secured in no time! 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00896 · 59.2th percentile
Published
2022-08-30T15:07Z
EPSS history
Timeline
  • 30 AUG 15:07Z
    Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into…
    cvelistv5