Tenda RX2 Pro Firmware 16.03.30.14
Approved changes feed: RSS · Atom
cpe:2.3:o:tenda:rx2_pro_firmware:16.03.30.14:*:*:*:*:*:*:*
part: o version: 16.03.30.14 update: *
| Vendor | Tenda (cebb1c0a-7ddd-5bf6-9fc6-52b2b4f8dd42) |
|---|---|
| Product | Rx2 Pro Firmware (5cfffa7d-7f14-5555-ba8f-17409704d1d6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-46635 |
vulnerable | 2026-06-08 07:27:08.534904 |
Details available
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the router and/or resources and devices on other networks hosted by the router by configuring a static IP address (within the non-guest subnet) on their host.
Published: 2025-05-01T00:00:00.000Z
Updated: 2025-05-02T14:46:52.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46634 |
vulnerable | 2026-06-08 07:27:08.534504 |
Details available
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after the user has transmitted the hash of their password in cleartext. The hash can be replayed to authenticate.
Published: 2025-05-01T00:00:00.000Z
Updated: 2025-05-02T14:56:33.145Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46633 |
vulnerable | 2026-06-08 07:27:08.534209 |
Details available
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AES key in sent in cleartext in response to successful authentication. The IV is always EU5H62G9ICGRNI43.
Published: 2025-05-01T00:00:00.000Z
Updated: 2025-05-02T14:59:18.138Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46632 |
vulnerable | 2026-06-08 07:27:08.533680 |
Details available
Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.
Published: 2025-05-01T00:00:00.000Z
Updated: 2025-05-02T15:04:06.366Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46631 |
vulnerable | 2026-06-08 07:27:08.533214 |
Details available
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request.
Published: 2025-05-01T00:00:00.000Z
Updated: 2025-05-02T15:05:39.836Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46630 |
vulnerable | 2026-06-08 07:27:08.532816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46629 |
vulnerable | 2026-06-08 07:27:08.532326 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46628 |
vulnerable | 2026-06-08 07:27:08.531720 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46627 |
vulnerable | 2026-06-08 07:27:08.531298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46626 |
vulnerable | 2026-06-08 07:27:08.530857 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46625 |
vulnerable | 2026-06-08 07:27:08.529684 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.