PT-2025-18706 · Tenda · Tenda Rx2 Pro

Published 2025-05-01 · Updated 2025-05-03 · CVE-2025-46632

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tenda RX2 Pro version 16.03.30.14

Description The issue concerns the reuse of the initialization vector (IV) in the web management portal, which may allow an attacker to discern information or more easily decrypt encrypted messages between the client and server.

Recommendations For Tenda RX2 Pro version 16.03.30.14, consider disabling the web management portal until a patch is available to prevent potential exploitation. Restrict access to the portal to minimize the risk of information disclosure or decryption of encrypted messages.

Exploit

Fix

Weakness Enumeration

CWE-323

Related Identifiers

BDU:2025-05636

CVE-2025-46632

Affected Products

Tenda Rx2 Pro

References · 8

• 🔥 https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46632-static-iv-use-in-httpd · Exploit
• https://osv.dev/vulnerability/CVE-2025-46632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46632 · Security Note
• https://bdu.fstec.ru/vul/2025-05636 · Security Note
• https://tendacn.com/us/default.html · Note
• https://twitter.com/CVEnew/status/1918745369699058168 · Twitter Post
• https://t.me/cvetracker/22868 · Telegram Post
• https://t.me/cvedetector/24264 · Telegram Post