Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.
References
| Link | Resource |
|---|---|
| https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd | Third Party Advisory Exploit |
| https://www.tendacn.com/us/default.html | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
27 May 2025, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd - Third Party Advisory, Exploit | |
| References | () https://www.tendacn.com/us/default.html - Product | |
| CPE | cpe:2.3:h:tenda:rx2_pro:-:*:*:*:*:*:*:* cpe:2.3:o:tenda:rx2_pro_firmware:16.03.30.14:*:*:*:*:*:*:* |
|
| First Time |
Tenda rx2 Pro
Tenda Tenda rx2 Pro Firmware |
02 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
| CWE | CWE-326 |
02 May 2025, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
01 May 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-01 20:15
Updated : 2025-05-27 14:22
NVD link : CVE-2025-46626
Mitre link : CVE-2025-46626
CVE.ORG link : CVE-2025-46626
JSON object : View
Products Affected
tenda
- rx2_pro_firmware
- rx2_pro
CWE
CWE-326
Inadequate Encryption Strength