CVE-2025-46626

HIGH EPSS 9.6%
Published May 1, 20251y ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
High
Find Similar
Published May 1, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.

CVSS Details

Base Score
7.3
Exploitability
3.9
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
9.6% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-326

Affected Products 2

VendorProductVersionRange
tendarx2_pro_firmware16.03.30.14any
tendarx2_pro*any

References 2

  • blog.uturn.dev https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd
    ExploitThird Party Advisory
  • tendacn.com https://www.tendacn.com/us/default.html
    Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.