PT-2025-18701 · Tenda · Tenda Rx2 Pro

Published 2025-05-01 · Updated 2025-05-03 · CVE-2025-46627

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tenda RX2 Pro version 16.03.30.14

Description The issue concerns the use of weak credentials, allowing an unauthenticated attacker to authenticate to the telnet service. This is achieved by calculating the root password based on easily obtained device information, specifically the last two digits/octets of the MAC address.

Recommendations For Tenda RX2 Pro version 16.03.30.14, consider changing the default root password to a strong and unique one to prevent unauthorized access to the telnet service. As a temporary workaround, restrict access to the telnet service until a more secure authentication mechanism is implemented.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

BDU:2025-05629

CVE-2025-46627

Affected Products

Tenda Rx2 Pro

References · 10

• 🔥 https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46627-calculated-os-root-password · Exploit
• https://osv.dev/vulnerability/CVE-2025-46627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46627 · Security Note
• https://bdu.fstec.ru/vul/2025-05629 · Security Note
• https://tendacn.com/us/default.html · Note
• https://t.me/cvetracker/22863 · Telegram Post
• https://t.me/cvedetector/24270 · Telegram Post
• https://twitter.com/transilienceai/status/1918091343072747821 · Twitter Post
• https://twitter.com/CVEnew/status/1918745365475369302 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1918065504666763518 · Twitter Post