PT-2025-18699 · Tenda · Tenda Rx2 Pro

Published 2025-05-01 · Updated 2025-05-27 · CVE-2025-46625

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda RX2 Pro version 16.03.30.14

Description The issue is related to a lack of input validation/sanitization in the setLanCfg API endpoint in httpd, allowing a remote attacker authorized to the web management portal to gain root shell access to the device by sending a crafted web request. This is a persistent issue because the command injection is saved in the device's configuration.

Recommendations For Tenda RX2 Pro version 16.03.30.14, as a temporary workaround, consider disabling the setLanCfg API endpoint until a patch is available. Restrict access to the web management portal to minimize the risk of exploitation. Avoid using the setLanCfg endpoint in the affected API until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-05628

CVE-2025-46625

Affected Products

Tenda Rx2 Pro

References · 10

• https://osv.dev/vulnerability/CVE-2025-46625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46625 · Security Note
• https://bdu.fstec.ru/vul/2025-05628 · Security Note
• https://tendacn.com/us/default.html · Note
• https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd · Note
• https://twitter.com/dailycve/status/1927411909046796485 · Twitter Post
• https://t.me/cvedetector/24268 · Telegram Post
• https://t.me/cvetracker/22861 · Telegram Post
• https://twitter.com/cybercronai/status/1918429201448722713 · Twitter Post
• https://twitter.com/CVEnew/status/1918745363751535006 · Twitter Post