CVE-2025-46625: Root Shell Access Exploit in Tenda RX2 Pro Router

Overview

The CVE-2025-46625 vulnerability poses a significant risk to owners of the Tenda RX2 Pro routers, specifically those using the 16.03.30.14 version. The vulnerability, which lies in the ‘setLanCfg’ API endpoint in httpd, can be exploited by remote attackers who have been authorized to the web management portal.
The gravity of this vulnerability is significant as it allows an attacker to gain root shell access by sending a crafted web request to the device. This could potentially lead to system compromise or data leakage, posing a significant risk to user privacy and network security.

Vulnerability Summary

CVE ID: CVE-2025-46625
Severity: High (8.8 CVSS Severity Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

Tenda RX2 Pro | 16.03.30.14

How the Exploit Works

The exploit works by taking advantage of a lack of input validation/sanitization in the ‘setLanCfg’ API endpoint in httpd. An attacker who has access to the web management portal of the Tenda RX2 Pro router sends a specially crafted web request to the device. This request takes advantage of the API endpoint’s lack of input validation to inject commands directly into the device’s configuration.
Because the injected commands are saved in the device’s configuration, they persist even after the device is restarted. This allows the attacker to maintain root shell access to the device, potentially leading to a complete system compromise.

Conceptual Example Code

Here’s an example of a malicious HTTP request an attacker might send to exploit this vulnerability:

POST /api/setLanCfg HTTP/1.1
Host: target.router.com
Content-Type: application/json
{
"lanCfg": "; rm -rf /; #"
}

In this example, the attacker sends an HTTP POST request to the ‘setLanCfg’ API endpoint. The attacker uses the lack of input validation to inject a command (`rm -rf /; #`) into the device’s configuration. This command would, in theory, delete all files on the device, illustrating the severity of the potential impact of this vulnerability.