CVE-2025-46629

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-01 · updated 2026-06-17
Weakness: CWE-284

Description

Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet

Affected products

Tenda Rx2 Pro Firmware: 16.03.30.14

References

https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46629-lack-of-authentication-in-ate
https://www.tendacn.com/us/default.html

Get alerted when CVE-2025-46629 or the next vulnerability affects your stack