CVE-2025-14636

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14636
A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.336361 Permissions Required VDB Entry
https://vuldb.com/?id.336361 Third Party Advisory VDB Entry
https://vuldb.com/?submit.707213 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:ax9_firmware:22.03.01.46:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ax9:-:*:*:*:*:*:*:*
History

24 Feb 2026, 06:16

Type Values Removed Values Added
Summary (en) A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be exploited. (en) A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

18 Dec 2025, 02:28

Type Values Removed Values Added
CPE cpe:2.3:o:tenda:ax9_firmware:22.03.01.46:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ax9:-:*:*:*:*:*:*:*
References () https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md - () https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.336361 - () https://vuldb.com/?ctiid.336361 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.336361 - () https://vuldb.com/?id.336361 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.707213 - () https://vuldb.com/?submit.707213 - Third Party Advisory, VDB Entry
References () https://www.tenda.com.cn/ - () https://www.tenda.com.cn/ - Product
First Time Tenda
Tenda ax9
Tenda ax9 Firmware

13 Dec 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-13 19:15

Updated : 2026-02-24 06:16

NVD link : CVE-2025-14636

Mitre link : CVE-2025-14636

CVE.ORG link : CVE-2025-14636

JSON object : View

Products Affected

tenda

  • ax9_firmware
  • ax9
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-328

Use of Weak Hash