PT-2025-35587 · Tenda · Tenda Cp6

Iot_Res · Published 2025-09-02 · Updated 2025-09-02 · CVE-2025-9828

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tenda CP6 version 11.10.00.243

Description A vulnerability exists in the function sub 2B7D04 of the uhttp component. Manipulation of this function can lead to a risky cryptographic algorithm. This attack can be launched remotely and is characterized by high complexity, with exploitability described as difficult. The exploit has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-310

Related Identifiers

CVE-2025-9828

Affected Products

Tenda Cp6

References · 8

• 🔥 https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/CP6.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-9828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9828 · Security Note
• https://vuldb.com/?ctiid.322175 · Note
• https://twitter.com/CVEnew/status/1962931082162061457 · Twitter Post
• https://tenda.com.cn · Note
• https://vuldb.com/?submit.641566 · Note
• https://vuldb.com/?id.322175 · Note