Read the docs
TI-2025-10696 Aliases CVE-2025-11666GHSA-gmjf-fc5r-h6v2

Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password

Priority LOW 36CWE-255Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-259.

Summary

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TendaRP3 Pro22.5.7.0; 22.5.7.1; 22.5.7.2; 22.5.7.3; 22.5.7.4; 22.5.7.5; 22.5.7.6; 22.5.7.7; 22.5.7.8; 22.5.7.9; 22.5.7.10; 22.5.7.11; 22.5.7.12; 22.5.7.13; 22.5.7.14; 22.5.7.15; 22.5.7.16; 22.5.7.17; 22.5.7.18; 22.5.7.19; 22.5.7.20; 22.5.7.21; 22.5.7.22; 22.5.7.23; 22.5.7.24; 22.5.7.25; 22.5.7.26; 22.5.7.27; 22.5.7.28; 22.5.7.29; 22.5.7.30; 22.5.7.31; 22.5.7.32; 22.5.7.33; 22.5.7.34; 22.5.7.35; 22.5.7.36; 22.5.7.37; 22.5.7.38; 22.5.7.39; 22.5.7.40; 22.5.7.41; 22.5.7.42; 22.5.7.43; 22.5.7.44; 22.5.7.45; 22.5.7.46; 22.5.7.47; 22.5.7.48; 22.5.7.49; 22.5.7.50; 22.5.7.51; 22.5.7.52; 22.5.7.53; 22.5.7.54; 22.5.7.55; 22.5.7.56; 22.5.7.57; 22.5.7.58; 22.5.7.59; 22.5.7.60; 22.5.7.61; 22.5.7.62; 22.5.7.63; 22.5.7.64; 22.5.7.65; 22.5.7.66; 22.5.7.67; 22.5.7.68; 22.5.7.69; 22.5.7.70; 22.5.7.71; 22.5.7.72; 22.5.7.73; 22.5.7.74; 22.5.7.75; 22.5.7.76; 22.5.7.77; 22.5.7.78; 22.5.7.79; 22.5.7.80; 22.5.7.81; 22.5.7.82; 22.5.7.83; 22.5.7.84; 22.5.7.85; 22.5.7.86; 22.5.7.87; 22.5.7.88; 22.5.7.89; 22.5.7.90; 22.5.7.91; 22.5.7.92; 22.5.7.93—No fix listedCNA
  • RP3 Pro VendorTenda Affected 22.5.7.0; 22.5.7.1; 22.5.7.2; 22.5.7.3; 22.5.7.4; 22.5.7.5; 22.5.7.6; 22.5.7.7; 22.5.7.8; 22.5.7.9; 22.5.7.10; 22.5.7.11; 22.5.7.12; 22.5.7.13; 22.5.7.14; 22.5.7.15; 22.5.7.16; 22.5.7.17; 22.5.7.18; 22.5.7.19; 22.5.7.20; 22.5.7.21; 22.5.7.22; 22.5.7.23; 22.5.7.24; 22.5.7.25; 22.5.7.26; 22.5.7.27; 22.5.7.28; 22.5.7.29; 22.5.7.30; 22.5.7.31; 22.5.7.32; 22.5.7.33; 22.5.7.34; 22.5.7.35; 22.5.7.36; 22.5.7.37; 22.5.7.38; 22.5.7.39; 22.5.7.40; 22.5.7.41; 22.5.7.42; 22.5.7.43; 22.5.7.44; 22.5.7.45; 22.5.7.46; 22.5.7.47; 22.5.7.48; 22.5.7.49; 22.5.7.50; 22.5.7.51; 22.5.7.52; 22.5.7.53; 22.5.7.54; 22.5.7.55; 22.5.7.56; 22.5.7.57; 22.5.7.58; 22.5.7.59; 22.5.7.60; 22.5.7.61; 22.5.7.62; 22.5.7.63; 22.5.7.64; 22.5.7.65; 22.5.7.66; 22.5.7.67; 22.5.7.68; 22.5.7.69; 22.5.7.70; 22.5.7.71; 22.5.7.72; 22.5.7.73; 22.5.7.74; 22.5.7.75; 22.5.7.76; 22.5.7.77; 22.5.7.78; 22.5.7.79; 22.5.7.80; 22.5.7.81; 22.5.7.82; 22.5.7.83; 22.5.7.84; 22.5.7.85; 22.5.7.86; 22.5.7.87; 22.5.7.88; 22.5.7.89; 22.5.7.90; 22.5.7.91; 22.5.7.92; 22.5.7.93 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-11666
  2. 2026-10-03 Alias added: GHSA-gmjf-fc5r-h6v2

References

Exploit 1

Other 1

  • TI-2021-11772 An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08863 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10434 An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78650 Stack-based buffer overflow in Tenda AC19 web management service CVSS 4.0CRITICAL 10.0
  • TI-2026-66119 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow CVSS 4.0CRITICAL 10.0
  • TI-2026-57025 Tenda AC18 Telnet telnet missing authentication CVSS 4.0CRITICAL 10.0
See all 1963 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences