TI-2025-29336 CVE-2025-46635 · GHSA-qmqc-h5gj-qcf5
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices.
Priority LOW 31
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices.
Vulnerabilities
11 records
TI-2025-29335 CVE-2025-46634 · GHSA-pm2w-vj7f-h667
Cleartext transmission of sensitive information in the web management portal of the Tenda…
Priority LOW 35
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials f…
TI-2025-29334 CVE-2025-46633 · GHSA-pjhx-jp78-8pv5
Cleartext transmission of sensitive information in the web management portal of the Tenda…
Priority LOW 35
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from c…
TI-2025-29333 CVE-2025-46632 · GHSA-wf34-hx5v-vq6q
Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro…
Priority LOW 29
Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.
TI-2025-29332 CVE-2025-46631 · GHSA-vv7q-66vv-9jp3
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14…
Priority LOW 39
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request.
TI-2025-29331 CVE-2025-46630 · GHSA-923h-v2w5-rh8q
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14…
Priority LOW 29
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request.
TI-2025-29330 CVE-2025-46629 · GHSA-f57c-fm3p-ggmf
Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14…
Priority LOW 30
Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled…
TI-2025-29329 CVE-2025-46628 · GHSA-gcrr-4ph4-qm58
Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2…
Priority LOW 36
Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the…
TI-2025-29328 CVE-2025-46627 · GHSA-w5qh-gchv-44g2
Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated…
Priority LOW 36
Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information.
TI-2025-29327 CVE-2025-46626 · GHSA-gc4p-7qxx-hhrw
Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate'…
Priority LOW 32
Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.
TI-2025-29326 CVE-2025-46625 · GHSA-q25g-m88j-xmgx
Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the…
Priority MEDIUM 42
Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to the web management portal to gain root shell access to the de…