← Vulnerability feed

Vulnerability record · CVE-2025-46628 · published 1 May 2025

CVE-2025-46628: Tenda rx2 pro firmware improper access control vulnerability

Tenda · Rx2 Pro Firmware

Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed.

7.3 CVSS 3.1 High EPSS 1.0% · top 38.5% CWE-284 · Improper access control
7.3CVSS 3.1 base score
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46628-command-injection-through-ifconfig-c ExploitThird Party Advisory
https://www.tendacn.com/us/default.html Product

Track CVE-2025-46628 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2025-46625Tenda rx2 pro firmware command injection vulnerabilityLack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is auth…EPSS 0.85%8.2CVE-2025-46633Tenda rx2 pro firmware cleartext storage of sensitive data vulnerabilityCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic b…EPSS 0.26%8.2CVE-2025-46634Tenda rx2 pro firmware cleartext storage of sensitive data vulnerabilityCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker t…EPSS 0.17%8.2CVE-2025-46627Tenda rx2 pro firmware vulnerabilityUse of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the …EPSS 0.43%7.3CVE-2025-46626Tenda rx2 pro firmware inadequate encryption strength vulnerabilityReuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an …EPSS 0.23%7.1CVE-2025-46635Tenda rx2 pro firmware improper access control vulnerabilityAn issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces…EPSS 0.33%6.5CVE-2025-46631Tenda rx2 pro firmware improper authentication vulnerabilityImproper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet acc…EPSS 7.5%6.5CVE-2025-46632Tenda rx2 pro firmware vulnerabilityInitialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or …EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2025-46628), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.