PT-2025-41760 · Tenda · Tenda Rp3 Pro

Iot_Res · Published 2025-10-11 · Updated 2025-10-13 · CVE-2025-11666

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda RP3 Pro versions through 22.5.7.93

Description A security issue exists in Tenda RP3 Pro up to version 22.5.7.93, specifically within the Firmware Update Handler component. Manipulation of the current force upgrade pwd argument in the force upgrade.sh file can result in the use of a hard-coded password. This issue can only be exploited locally. The exploit for this issue has been published.

Recommendations Update to a version later than 22.5.7.93.

Exploit

Fix

Weakness Enumeration

CWE-255

CWE-259

Related Identifiers

BDU:2025-13329

CVE-2025-11666

Affected Products

Tenda Rp3 Pro

References · 9

• 🔥 https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11666 · Security Note
• https://bdu.fstec.ru/vul/2025-13329 · Security Note
• https://t.me/CVEtracker/34751 · Telegram Post
• https://t.me/cveNotify/138423 · Telegram Post
• https://vuldb.com/?ctiid.328085 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/?submit.673128 · Note
• https://vuldb.com/?id.328085 · Note