PT-2025-18704 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to inadequate access controls in the web management portal, allowing an unauthenticated remote attacker to enable ate, a remote system management binary, by sending a...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an access control error vulnerability that can be exploited by an attacker to enable ate management binary...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an information disclosure vulnerability that can be exploited by an attacker to collect credentials for authentication...

CVE-2025-46626

Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an input validation error vulnerability that stems from a lack of input validation in the setLanCfg API endpoint, which can be exploited by an attacker to gain root shell access...

CVE-2025-46627

CVE-2025-46627 concerns a weak-credentials issue in the Tenda RX2 Pro. Affected: Tenda RX2 Pro with firmware 16.03.30.14. Description from multiple sources: an unauthenticated attacker can authenticate to the Telnet service by deriving the root password from easily obtainable device information, ...

CVE-2025-46629

Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet...

PT-2025-18705 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to inadequate access controls in the web management portal, allowing an unauthenticated remote attacker to enable telnet access to the router's operating system. This can be...

PT-2025-18708 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The web management portal of the Tenda RX2 Pro transmits sensitive information, including the hash of the user's password, in cleartext. This could allow an unauthenticated attacker to collect...

PT-2025-18700 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue concerns the reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service. This allows an attacker to decrypt, replay, and/or forge traffic ...

CVE-2025-46625

The CVE concerns the Tenda RX2 Pro (firmware 16.03.30.14) where lack of input validation/sanitization in the httpd setLanCfg API enables an authorized attacker to achieve root shell access via a crafted request. The vulnerability is persisted because the command injection is saved in the device c...

CVE-2025-46635

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker who is authenticated to the guest Wi-Fi to access resources on the router and/or resources and devices on other...

CVE-2025-46628

Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed...

PT-2025-18706 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue concerns the reuse of the initialization vector IV in the web management portal, which may allow an attacker to discern information or more easily decrypt encrypted messages between the...

PT-2025-18703 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to a lack of access controls in the 'ate' management binary, allowing an unauthenticated remote attacker to make unauthorized configuration changes to any router where 'ate' ...

Tenda RX2 Pro 安全漏洞

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. An Access Control Error vulnerability exists in Tenda RX2 Pro version 16.03.30.14, which stems from a lack of access control in the ate management binary, and can be exploited by an attacker to cause unauthorized...

CVE-2025-46632

Initialization vector IV reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server...

PT-2025-18699 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to a lack of input validation/sanitization in the setLanCfg API endpoint in httpd, allowing a remote attacker authorized to the web management portal to gain root shell acces...

CVE-2025-46635

CVE-2025-46635 relates to Tenda RX2 Pro (firmware 16.03.30.14). The issue is improper network isolation between the guest Wi‑Fi network and other router interfaces, enabling an authenticated guest to access router resources and other networks by configuring a static IP in the non‑guest subnet on ...

PT-2025-18709 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: An issue was discovered that allows an attacker, who is authenticated to the guest Wi-Fi network, to access resources on the router and/or resources and devices on other networks hosted by the...