CVE-2025-46630

Published: May 1, 2025Modified: May 27, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request.

Affected (1)

Products: Tenda: Rx2 Pro Firmware

Tenda

1 product

Rx2 Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tenda Rx2 Pro Firmware	Version 16.03.30.14

Running on/with	Platform Versions
Tenda Rx2 Pro	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46630-enable-ate-unauthenticated-through-httpd

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.tendacn.com/us/default.html

Source: cve@mitre.org

Product

Timeline

No history available yet.