Tenda i24 Shadow File hard-coded credentials
Priority LOW 38CWE-259Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-259.
Summary
A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the component Shadow File. Such manipulation with the input Fireitup leads to hard-coded credentials. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00137 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tenda | i24 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | 4G03 Pro | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | 4G05 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | 4G08 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | G0-8G-PoE | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | Nova MW5G | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
| Tenda | TEG5328F | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | — | No fix listed | CNA |
- i24 VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- 4G03 Pro VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- 4G05 VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- 4G08 VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- G0-8G-PoE VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- Nova MW5G VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
- TEG5328F VendorTenda Affected 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15371
- 2026-10-03 Alias added: GHSA-9qhr-gr34-rmgj
References
More Tenda vulnerabilities
- TI-2021-11772 An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-08863 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10434 An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7)… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78650 Stack-based buffer overflow in Tenda AC19 web management service CVSS 4.0CRITICAL 10.0
- TI-2026-66119 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow CVSS 4.0CRITICAL 10.0
- TI-2026-57025 Tenda AC18 Telnet telnet missing authentication CVSS 4.0CRITICAL 10.0
Sources
- CVE-2025-15371 · CVE Program
- CVE-2025-15371 · NVD
- FIRST EPSS
- GHSA-9qhr-gr34-rmgj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences