CVE-2025-46627: Weak Credentials Vulnerability in Tenda RX2 Pro

Overview

The Common Vulnerabilities and Exposures (CVE) system has identified a flaw, known as CVE-2025-46627, that presents a significant risk to users of the Tenda RX2 Pro with version 16.03.30.14. This flaw arises from the use of weak credentials, which can potentially allow an unauthenticated attacker to gain access to the telnet service. The significance of this vulnerability lies in its potential to compromise the system or lead to data leakage, thereby posing a substantial threat to the privacy and security of users.
This vulnerability is specifically problematic because the root password, which an attacker may calculate, is based on easily obtainable device information – the last two digits or octets of the MAC address. As such, anyone with access to this information could potentially exploit this vulnerability, compromising user data and system integrity.

Vulnerability Summary

CVE ID: CVE-2025-46627
Severity: High (8.2 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

Tenda RX2 Pro | 16.03.30.14

How the Exploit Works

The vulnerability arises from the use of a weak authentication mechanism in the Tenda RX2 Pro. Specifically, the device relies on the last two digits or octets of the MAC address to generate the root password. An attacker can easily obtain this information, calculate the root password, and authenticate to the telnet service. Since this does not require any user interaction or special privileges, it further escalates the risk posed by this vulnerability.

Conceptual Example Code

An attacker could potentially exploit this vulnerability using a simple shell command like the one below:

telnet target_IP
Trying target_IP...
Connected to target_IP.
Escape character is '^]'.
login: root
password: {calculated_based_on_MAC_address}
# Successful login

Here, the attacker simply needs to replace “target_IP” with the IP address of the target device and “{calculated_based_on_MAC_address}” with the password calculated based on the MAC address. Once the attacker has successfully logged in, they gain root access and can perform any action on the device, leading to a potential system compromise and data leakage.
As a measure to address this vulnerability, users are advised to apply the vendor patch when it becomes available or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure.