CVE-2025-46630

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2025-05-01

Last modified

2025-05-02

Weaknesses

CWE-287

Affected products

• Rx2 Pro Firmware (Tenda)

References

• https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46630-enable-ate-unauthenticated-through-…
• https://www.tendacn.com/us/default.html