{"id":36613,"date":"2025-05-09T07:52:28","date_gmt":"2025-05-09T07:52:28","guid":{"rendered":""},"modified":"2025-06-13T17:21:47","modified_gmt":"2025-06-13T23:21:47","slug":"cve-2025-46625-root-shell-access-exploit-in-tenda-rx2-pro-router","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-46625-root-shell-access-exploit-in-tenda-rx2-pro-router\/","title":{"rendered":"CVE-2025-46625: Root Shell Access Exploit in Tenda RX2 Pro Router<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-46625 vulnerability poses a significant risk to owners of the Tenda RX2 Pro routers, specifically those using the 16.03.30.14 version. The vulnerability, which lies in the ‘setLanCfg’ API endpoint in httpd, can be exploited by remote attackers who have been authorized to the web management portal.
\nThe gravity of this vulnerability is significant as it allows<\/a> an attacker to gain root shell access by sending a crafted web request to the device. This could potentially lead to system<\/a> compromise or data leakage, posing a significant risk to user privacy and network security.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-46625
\nSeverity: High (8.8 CVSS Severity Score)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Tenda RX2<\/a> Pro | 16.03.30.14<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit works by taking advantage of a lack of input validation\/sanitization in the ‘setLanCfg’ API endpoint<\/a> in httpd. An attacker who has access to the web management<\/a> portal of the Tenda RX2 Pro router sends a specially crafted web request to the device. This request takes advantage of the API endpoint’s lack of input validation to inject commands<\/a> directly into the device’s configuration.
\nBecause the injected commands<\/a> are saved in the device’s configuration, they persist even after the device is restarted. This allows the attacker to maintain root shell access<\/a> to the device, potentially leading to a complete system compromise.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s an example of a malicious HTTP request an attacker might send to exploit this vulnerability<\/a>:<\/p>\n

POST \/api\/setLanCfg HTTP\/1.1\nHost: target.router.com\nContent-Type: application\/json\n{\n\"lanCfg\": \"; rm -rf \/; #\"\n}<\/code><\/pre>\n
In this example, the attacker sends an HTTP POST request<\/a> to the ‘setLanCfg’ API endpoint. The attacker uses the lack of input validation to inject a command<\/a> (`rm -rf \/; #`) into the device’s configuration. This command would, in theory, delete all files<\/a> on the device, illustrating the severity of the potential impact of this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-46625 vulnerability poses a significant risk to owners of the Tenda RX2 Pro routers, specifically those using the 16.03.30.14 version. The vulnerability, which lies in the ‘setLanCfg’ API endpoint in httpd, can be exploited by remote attackers who have been authorized to the web management portal. The gravity of this vulnerability is significant […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[103],"product":[104],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-36613","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-apache","product-apache-httpd"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t