{"id":36613,"date":"2025-05-09T07:52:28","date_gmt":"2025-05-09T07:52:28","guid":{"rendered":""},"modified":"2025-06-13T17:21:47","modified_gmt":"2025-06-13T23:21:47","slug":"cve-2025-46625-root-shell-access-exploit-in-tenda-rx2-pro-router","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-46625-root-shell-access-exploit-in-tenda-rx2-pro-router\/","title":{"rendered":"CVE-2025-46625: Root Shell Access Exploit in Tenda RX2 Pro Router<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-46625 vulnerability poses a significant risk to owners of the Tenda RX2 Pro routers, specifically those using the 16.03.30.14 version. The vulnerability, which lies in the ‘setLanCfg’ API endpoint in httpd, can be exploited by remote attackers who have been authorized to the web management portal.
\nThe gravity of this vulnerability is significant as it allows<\/a> an attacker to gain root shell access by sending a crafted web request to the device. This could potentially lead to system<\/a> compromise or data leakage, posing a significant risk to user privacy and network security.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-46625
\nSeverity: High (8.8 CVSS Severity Score)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n