CVE-2021-47802: Tenda D151 & D301 - Configuration Download

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-21 · updated 2026-10-27
Weakness: CWE-306

Description

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.

Affected products

Tenda D151 Firmware: all versions
Tenda D301 Firmware: all versions
Shenzhen Tenda Technology Co.,Ltd. Tenda D151 & D301: all versions

References

https://www.exploit-db.com/exploits/49782
https://www.tendacn.com/us/
https://www.vulncheck.com/advisories/tenda-d-d-configuration-download

Get alerted when CVE-2021-47802 or the next vulnerability affects your stack