CVE-2025-46626

Published: May 1, 2025Modified: May 27, 2025

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.

Affected (1)

Products: Tenda: Rx2 Pro Firmware

Tenda

1 product

Rx2 Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tenda Rx2 Pro Firmware	Version 16.03.30.14

Running on/with	Platform Versions
Tenda Rx2 Pro	All versions

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.tendacn.com/us/default.html

Source: cve@mitre.org

Product

Timeline

No history available yet.