PT-2025-35520 · Tenda · Tenda Fh1202

Yu Bao · Published 2025-08-25 · Updated 2025-09-02 · CVE-2025-9806

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda F1202 versions 1.2.0.9 through 1.2.0.20

Description A vulnerability exists in the Tenda F1202 device, specifically impacting an unknown function within the /etc ro/shadow file of the Administrative Interface component. Manipulation of the input Fireitup causes the disclosure of hard-coded credentials. This issue can only be exploited locally and requires a high degree of complexity. The exploit has been publicly disclosed.

Recommendations Update Tenda F1202 to a version beyond 1.2.0.20.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

BDU:2025-10880

CVE-2025-9806

Affected Products

Tenda Fh1202

References · 11

• 🔥 https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md#steps-to-reproduce · Exploit
• https://bdu.fstec.ru/vul/2025-10880 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-9806 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9806 · Vendor Advisory
• https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md · Note
• https://tenda.com.cn · Note
• https://vuldb.com/?submit.640980 · Note
• https://twitter.com/CVEnew/status/1962683393826517359 · Twitter Post
• https://vuldb.com/?ctiid.322130 · Note
• https://t.me/CVEtracker/31470 · Telegram Post
• https://vuldb.com/?id.322130 · Note