CVE-2021-47802 Tenda D151 & D301 - Configuration Download
Remote attackers can download router configuration files containing admin credentials without authentication via the /goform/getimage endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47802?
CVE-2021-47802 is a high-severity vulnerability in Shenzhen Tenda Technology Co.,Ltd. Tenda D151 & D301, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.
Weakness: CWE-306
Which versions are affected by CVE-2021-47802?
It affects 2 products.
Products include Tenda D151 Firmware, Tenda D301 Firmware.
How do I fix CVE-2021-47802?
No fix has been published for CVE-2021-47802 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-47802 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47802 exists.
Sources
Also known as GHSA-wh72-mc55-37hv.