CVE-2025-9309

Katalog CVE

CVSS 7.0 · High EPSS 0,21%

Kerentanan Use of Hard-coded Password pada tenda ac10 firmware. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made public and could be used.

Rincian

Terbit di NVD

21 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-259: Use of Hard-coded Password
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md exploit · advisory pihak ketiga
• https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md#steps-to-reproduce exploit · advisory pihak ketiga
• https://vuldb.com/?id.320914 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.633585 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.320914 permissions required · vdb entry
• https://www.tenda.com.cn/ product