CVE-2023-30351: tenda cp3_firmware Inadequate Encryption Strength
Vulnerability summary
CVE-2023-30351 is a high (CVSS 7.5) Inadequate Encryption Strength vulnerability in tenda cp3_firmware. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.1% of scored vulnerabilities.
Timeline
- 10-05-2023PublishedVulnerability first disclosed.
- 27-01-2025Last modifiedVulnerability information updated.
Description
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.
Affected systems
Tenda1 product
- cp3_firmware11.10.00.2211041355
1 vendor · 1 product
References
2 links- github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_RRA.mdThird Party Advisory
- github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_PRA.mdThird Party Advisory