CVE-2025-46631

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2025-05-01

Last modified

2025-05-02

Weaknesses

CWE-287

Affected products

• Rx2 Pro Firmware (Tenda)

References

• https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46631-enable-telnet-unauthenticated-throu…
• https://www.tendacn.com/us/default.html