PT-2025-33408 · Tenda · Tenda G1

Iot_Res · Published 2025-05-22 · Updated 2025-08-15 · CVE-2025-8980

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Tenda G1 version 16.01.7.8(3660)

Description: A vulnerability exists in the Tenda G1 device due to insufficient verification of data authenticity within the Firmware Update Handler component. The check upload file function is affected, allowing for potential remote code execution. Exploitation is considered difficult, but the exploit has been publicly disclosed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2025-10978

CVE-2025-8980

Affected Products

Tenda G1

References · 14

• 🔥 https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Auth.md · Exploit
• https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Inte.md · Patch
• https://osv.dev/vulnerability/CVE-2025-8980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8980 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-8980 · Security Note
• https://bdu.fstec.ru/vul/2025-10978 · Security Note
• https://twitter.com/VulmonFeeds/status/1956227993841381875 · Twitter Post
• https://t.me/CVEtracker/30053 · Telegram Post
• https://twitter.com/CVEnew/status/1956289065327976806 · Twitter Post
• https://vuldb.com/?submit.628606 · Note
• https://vuldb.com/?id.319976 · Note
• https://vuldb.com/?submit.628605 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/?ctiid.319976 · Note