CVE-2025-46635

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker who is authenticated to the guest Wi-Fi to access resources on the router and/or resources and devices on other...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an input validation error vulnerability that stems from a lack of input validation in the setLanCfg API endpoint, which can be exploited by an attacker to gain root shell access...

CVE-2025-46629

Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an information disclosure vulnerability that can be exploited by an attacker to collect credentials for authentication...

PT-2025-18707 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue concerns the cleartext transmission of sensitive information in the web management portal, allowing an attacker to decrypt traffic between the client and server by collecting the...

CVE-2025-46630

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' a remote system management binary by sending a /goform/ate web request...

CVE-2025-46627

CVE-2025-46627 concerns a weak-credentials issue in the Tenda RX2 Pro. Affected: Tenda RX2 Pro with firmware 16.03.30.14. Description from multiple sources: an unauthenticated attacker can authenticate to the Telnet service by deriving the root password from easily obtainable device information, ...

CVE-2025-46628

Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed...

PT-2025-18703 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to a lack of access controls in the 'ate' management binary, allowing an unauthenticated remote attacker to make unauthorized configuration changes to any router where 'ate' ...

PT-2025-18699 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to a lack of input validation/sanitization in the setLanCfg API endpoint in httpd, allowing a remote attacker authorized to the web management portal to gain root shell acces...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an input validation error vulnerability that stems from a lack of input validation in the ate management service, no details of the vulnerability are provided at this time...

CVE-2025-46632

Initialization vector IV reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server...

PT-2025-18706 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue concerns the reuse of the initialization vector IV in the web management portal, which may allow an attacker to discern information or more easily decrypt encrypted messages between the...

PT-2025-18709 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: An issue was discovered that allows an attacker, who is authenticated to the guest Wi-Fi network, to access resources on the router and/or resources and devices on other networks hosted by the...

CVE-2025-46635

CVE-2025-46635 relates to Tenda RX2 Pro (firmware 16.03.30.14). The issue is improper network isolation between the guest Wi‑Fi network and other router interfaces, enabling an authenticated guest to access router resources and other networks by configuring a static IP in the non‑guest subnet on ...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. An Access Control Error vulnerability exists in Tenda RX2 Pro version 16.03.30.14, which stems from a lack of access control in the ate management binary, and can be exploited by an attacker to cause unauthorized...

CVE-2025-46629

CVE-2025-46629 affects Tenda RX2 Pro (firmware 16.03.30.14). The issue is a lack of access controls in the 'ate' management binary, enabling an unauthenticated remote attacker to perform unauthorized configuration changes on any router where 'ate' is enabled by sending a crafted UDP packet. The a...

CVE-2025-46626

The CVE-2025-46626 entry concerns the Tenda RX2 Pro (firmware 16.03.30.14). The root cause is the reuse of a static AES key and initialization vector for encrypted traffic to the device’s ‘ate’ management service, enabling an attacker to decrypt, replay, and forge traffic targeting that service. ...

CVE-2025-46630

CVE-2025-46630 describes an access-control weakness in the Tenda RX2 Pro web management portal (firmware 16.03.30.14). An unauthenticated remote attacker can enable the remote system management binary named ate by issuing a request to the endpoint /goform/ate. Multiple sources corroborate: the CV...

CVE-2025-46629

Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet...