PT-2025-18702 · Tenda · Tenda Rx2 Pro

Published 2025-05-01 · Updated 2025-05-27 · CVE-2025-46628

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tenda RX2 Pro version 16.03.30.14

Description The issue is related to a lack of input validation/sanitization in the 'ate' management service, allowing an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. No authentication is required for this exploit.

Recommendations For Tenda RX2 Pro version 16.03.30.14, consider disabling the 'ate' management service until a patch is available to prevent unauthorized access. Restrict access to the 'ate' service to minimize the risk of exploitation.

Exploit

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-05630

CVE-2025-46628

Affected Products

Tenda Rx2 Pro

References · 10

• 🔥 https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46628-command-injection-through-ifconfig-command-in-ate · Exploit
• https://bdu.fstec.ru/vul/2025-05630 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46628 · Security Note
• https://tendacn.com/us/default.html · Note
• https://t.me/cvetracker/22864 · Telegram Post
• https://t.me/cvedetector/24271 · Telegram Post
• https://twitter.com/dailycve/status/1927410084797194462 · Twitter Post
• https://twitter.com/CVEnew/status/1918745366297518541 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1918062944757096603 · Twitter Post