Overview
The CVE-2025-46625 vulnerability poses a significant risk to owners of the Tenda RX2 Pro routers, specifically those using the 16.03.30.14 version. The vulnerability, which lies in the ‘setLanCfg’ API endpoint in httpd, can be exploited by remote attackers who have been authorized to the web management portal.
The gravity of this vulnerability is significant as it allows an attacker to gain root shell access by sending a crafted web request to the device. This could potentially lead to system compromise or data leakage, posing a significant risk to user privacy and network security.
Vulnerability Summary
CVE ID: CVE-2025-46625
Severity: High (8.8 CVSS Severity Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Tenda RX2 Pro | 16.03.30.14
How the Exploit Works
The exploit works by taking advantage of a lack of input validation/sanitization in the ‘setLanCfg’ API endpoint in httpd. An attacker who has access to the web management portal of the Tenda RX2 Pro router sends a specially crafted web request to the device. This request takes advantage of the API endpoint’s lack of input validation to inject commands directly into the device’s configuration.
Because the injected commands are saved in the device’s configuration, they persist even after the device is restarted. This allows the attacker to maintain root shell access to the device, potentially leading to a complete system compromise.
Conceptual Example Code
Here’s an example of a malicious HTTP request an attacker might send to exploit this vulnerability:
POST /api/setLanCfg HTTP/1.1
Host: target.router.com
Content-Type: application/json
{
"lanCfg": "; rm -rf /; #"
}In this example, the attacker sends an HTTP POST request to the ‘setLanCfg’ API endpoint. The attacker uses the lack of input validation to inject a command (`rm -rf /; #`) into the device’s configuration. This command would, in theory, delete all files on the device, illustrating the severity of the potential impact of this vulnerability.