CVE-2024-52788

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Nov 19, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-527898.0Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in CVE-2024-52793.5A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown fuCVE-2024-527917.5Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part oCVE-2024-527926.5LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affCVE-2024-527935.1The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing:CVE-2024-527946.1Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is CVE-2024-527965.3Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In vCVE-2024-527977.5Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's ElasCVE-2024-527987.7path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be CVE-2024-527998.2Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessivCVE-2024-52804.7The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaCVE-2024-528002.3veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transfo
CVE-2024-52788: High severity, CVSS 8.0 | Vulnix