Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46583 State: PUBLISHED Published: 2025-10-27T09:23:38.328Z Last Updated: 2025-10-27T15:47:46.207Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ZTE Products: MC889A Pro Problem Types: CWE-116 Description: There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2594779029512220894
CVE ID: CVE-2025-46584 State: PUBLISHED Published: 2025-05-06T07:00:54.166Z Last Updated: 2025-05-06T14:09:31.248Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-280 Description: Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46585 State: PUBLISHED Published: 2025-05-06T07:04:03.588Z Last Updated: 2025-05-06T14:05:54.112Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-787 Description: Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46586 State: PUBLISHED Published: 2025-05-06T07:05:19.066Z Last Updated: 2025-09-18T06:41:12.564Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-862 Description: Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46587 State: PUBLISHED Published: 2025-05-06T07:14:30.179Z Last Updated: 2025-05-06T14:03:05.411Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-264 Description: Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46588 State: PUBLISHED Published: 2025-05-06T07:16:28.523Z Last Updated: 2025-09-18T06:42:04.163Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-284 Description: Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46589 State: PUBLISHED Published: 2025-05-06T07:17:29.134Z Last Updated: 2025-09-18T06:42:35.029Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-284 Description: Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46590 State: PUBLISHED Published: 2025-05-06T07:18:32.156Z Last Updated: 2025-05-06T13:40:12.938Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-287 Description: Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypass authentication and enable access to some network search functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46591 State: PUBLISHED Published: 2025-05-06T07:19:18.660Z Last Updated: 2025-09-18T13:38:07.186Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-602 Description: Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46592 State: PUBLISHED Published: 2025-05-06T07:20:14.446Z Last Updated: 2025-05-06T13:27:01.969Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-476 Description: Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46593 State: PUBLISHED Published: 2025-05-06T07:21:03.582Z Last Updated: 2025-09-18T13:37:43.384Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-400 Description: Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2025-46595 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T14:28:38.447Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: backdropcms Products: Flag Problem Types: CWE-79 Description: An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a
his can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a role with permission to create links on the website, for example: create or edit comments or content with a filtered text format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://backdropcms.org/security/backdrop-sa-contrib-2025-011
CVE ID: CVE-2025-46599 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T14:28:05.811Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: K3s Products: K3s Problem Types: CWE-1188 Description: CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/f1veT/BUG/issues/2 - https://cloud.google.com/kubernetes-en
s: - CISA ADP Vulnrichment: References: - https://github.com/f1veT/BUG/issues/2 - https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port - https://github.com/k3s-io/k3s/issues/12164 - https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a - https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
CVE ID: CVE-2025-46602 State: PUBLISHED Published: 2025-10-27T18:41:46.258Z Last Updated: 2025-10-27T19:30:22.955Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: SupportAssist OS Recovery Problem Types: CWE-538 Description: Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000382443/dsa-2025-403
CVE ID: CVE-2025-46608 State: PUBLISHED Published: 2025-11-12T20:12:59.795Z Last Updated: 2025-11-13T21:23:27.791Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Data Lakehouse Problem Types: CWE-284 Description: Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with elevated privileges, compromising system integrity and customer data. Dell recommends customers upgrade to the latest
h elevated privileges, compromising system integrity and customer data. Dell recommends customers upgrade to the latest version at the earliest opportunity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000390529/dsa-2025-375-security-update-for-dell-data-lakehouse-multiple-vulnerabilities
CVE ID: CVE-2025-46610 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:23.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: ARTEC EMA Mail 6.92 allows CSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.artec-it.com/en-us/ema.html - https://www.syss.de/pentest-blog/csrf-und-xss-schwachstelle-in-ema-mail-von-artec-it-solutions-syss-2025-020/-021
CVE ID: CVE-2025-46611 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:18.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.artec-it.com/en-us/ema.html - https://www.syss.de/pentest-blog/csrf-und-xss-schwachstelle-in-ema-mail-von-artec-it-solutions-syss-2025-020/-021
CVE ID: CVE-2025-46612 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-10T14:44:36.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console (default credentials are weak and easily guessable) and upload a JSP file via the Panel Designer dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-036.txt
CVE ID: CVE-2025-46613 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T14:27:01.294Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: openplcproject Products: OpenPLC Problem Types: CWE-362 Description: OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thiagoralves/OpenPLC_v3/issues/273
CVE ID: CVE-2025-46614 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T15:56:23.048Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Snowflake Products: Snowflake ODBC Problem Types: CWE-532 Description: In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information into a Log File. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.snowflake.com/s/article/Snowflake-Connector-for-ODBC-Security-Advisory-CVE-2025-46614
CVE ID: CVE-2025-46616 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T15:21:30.937Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Quantum Products: StorNext Problem Types: CWE-434 Description: Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quantum.com/en/service-support/security-bulletins/stornext-gui-multiple-security-vulnerabilities-stornext-gui-multiple-secu
ntum.com/en/service-support/security-bulletins/stornext-gui-multiple-security-vulnerabilities-stornext-gui-multiple-security-vulnerabilities/
CVE ID: CVE-2025-46617 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T15:20:39.037Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Quantum Products: StorNext Problem Types: CWE-798 Description: Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quantum.com/en/service-support/security-bulletin
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quantum.com/en/service-support/security-bulletins/stornext-gui-multiple-security-vulnerabilities-stornext-gui-multiple-security-vulnerabilities/
CVE ID: CVE-2025-46618 State: PUBLISHED Published: 2025-04-25T14:32:34.480Z Last Updated: 2025-04-25T15:26:24.753Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-46619 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-01T18:54:24.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2025-46625 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T13:06:24.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to the web management portal to gain root shell access to the device by sending a crafted web request. This is persistent because the command injection is saved in the configuration of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?
ferences: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd
CVE ID: CVE-2025-46626 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:17:44.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd
CVE ID: CVE-2025-46627 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:15:49.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/octets of the MAC address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46627-calculated-os-root-password
CVE ID: CVE-2025-46628 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:13:51.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46628-command-injection-through-ifconfig-command-in-ate
CVE ID: CVE-2025-46629 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:11:42.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46629-lack-of-authentication-in-ate
CVE ID: CVE-2025-46630 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:07:14.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46630-enable-ate-unauthenticated-through-httpd
CVE ID: CVE-2025-46631 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:05:39.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46631-enable-telnet-unauthenticated-through-httpd
CVE ID: CVE-2025-46632 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:04:06.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46632-static-iv-use-in-httpd
CVE ID: CVE-2025-46633 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T14:59:18.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AES key in sent in cleartext in response to successful authentication. The IV is always EU5H62G9ICGRNI43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2
ichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46633-transmission-of-plaintext-symmetric-key-in-httpd
CVE ID: CVE-2025-46634 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T14:56:33.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after the user has transmitted the hash of their password in cleartext. The hash can be replayed to authenticate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46634-transmission-of-plaintext-credentials-in-httpd
CVE ID: CVE-2025-46635 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T14:46:52.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the router and/or resources and devices on other networks hosted by the router by configuring a static IP address (within the non-guest subnet) on their host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/default.html - https://blog.uturn.dev/#/writeups/iot-village/tenda-w18e/README?id=cve-2024-46435-delfacebookpic-stack-overflow
CVE ID: CVE-2025-46646 State: PUBLISHED Published: 2025-04-26T00:00:00.000Z Last Updated: 2025-04-29T15:23:02.330Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Artifex Products: Ghostscript Problem Types: CWE-24 Description: In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708311 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f14ea81e6c3d2f51593f23cdf13c4679a18f1a3f