Rx2 Pro Firmware (Tenda) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2025-05-01. Vendor: Tenda.
CVEs of Rx2 Pro Firmware
- CVE-2025-46631 - CVSS 6.5 (medium), 2025-05-01: Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to…
- CVE-2025-46634 - CVSS 8.2 (high), 2025-05-01: Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to…
- CVE-2025-46633 - CVSS 8.2 (high), 2025-05-01: Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between…
- CVE-2025-46632 - CVSS 6.5 (medium), 2025-05-01: Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more…
- CVE-2025-46635 - CVSS 7.1 (high), 2025-05-01: An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the…
- CVE-2025-46625 - CVSS 8.8 (high), 2025-05-01: Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to…
- CVE-2025-46628 - CVSS 7.3 (high), 2025-05-01: Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root…
- CVE-2025-46627 - CVSS 8.2 (high), 2025-05-01: Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root…
- CVE-2025-46630 - CVSS 6.5 (medium), 2025-05-01: Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote…
- CVE-2025-46626 - CVSS 7.3 (high), 2025-05-01: Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker…
- CVE-2025-46629 - CVSS 6.5 (medium), 2025-05-01: Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized…
