Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.
References
| Link | Resource |
|---|---|
| https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46632-static-iv-use-in-httpd | Third Party Advisory Exploit |
| https://www.tendacn.com/us/default.html | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
27 May 2025, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Tenda rx2 Pro
Tenda Tenda rx2 Pro Firmware |
|
| CPE | cpe:2.3:h:tenda:rx2_pro:-:*:*:*:*:*:*:* cpe:2.3:o:tenda:rx2_pro_firmware:16.03.30.14:*:*:*:*:*:*:* |
|
| References | () https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46632-static-iv-use-in-httpd - Third Party Advisory, Exploit | |
| References | () https://www.tendacn.com/us/default.html - Product |
02 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-323 |
02 May 2025, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
01 May 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-01 20:15
Updated : 2025-05-27 14:17
NVD link : CVE-2025-46632
Mitre link : CVE-2025-46632
CVE.ORG link : CVE-2025-46632
JSON object : View
Products Affected
tenda
- rx2_pro_firmware
- rx2_pro
CWE
CWE-323
Reusing a Nonce, Key Pair in Encryption