Tenda RX2 Pro 16.03.30.14 Wi-Fi Network access control

Summaryinfo

A vulnerability described as critical has been identified in Tenda RX2 Pro 16.03.30.14. Affected is an unknown function of the component Wi-Fi Network Handler. Such manipulation leads to access control. This vulnerability is referenced as CVE-2025-46635. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability was found in Tenda RX2 Pro 16.03.30.14 and classified as critical. Affected by this issue is an unknown code block of the component Wi-Fi Network Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the router and/or resources and devices on other networks hosted by the router by configuring a static IP address (within the non-guest subnet) on their host.

This vulnerability is handled as CVE-2025-46635 since 04/26/2025. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/26/2025). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-13259). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Tenda

Name

• RX2 Pro

Version

• 16.03.30.14

License

• commercial

Website

• Vendor: https://www.tenda.com.cn/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion