deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-44843
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/CloudSrvUserdataVersionCheck_url/readme.md; https://www.totolink.net
CVE: CVE-2025-44844
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/setUpgradeFW/readme.md
CVE: CVE-2025-44845
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/NTPSyncWithHost/readme.md
CVE: CVE-2025-44846
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/recvUpgradeNewFw/readme.md
CVE: CVE-2025-44847
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/setWebWlanIdx/readme.md
CVE: CVE-2025-44848
Published: 2025-05-01
Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/msg_process_Url/readme.md
CVE: CVE-2025-4173
Published: 2025-05-01
Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_cart of the file /oews/classes/Master.php?f=delete_cart. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/huashuocc/cve/blob/main/sql.md; https://vuldb.com/?ctiid.306793; https://vuldb.com/?id.306793
CVE: CVE-2025-32881
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to individuals. The app does not encrypt the GID in messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32882
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-353
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32883
Published: 2025-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-41722. Reason: This candidate is a reservation duplicate of CVE-2024-41722. Notes: All CVE users should reference CVE-2024-41722. instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-32884
Published: 2025-05-01
Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to individuals. The app does not encrypt the GID in messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32885
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1390
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32886
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing someone with local access to gain information about the protocol and intercept sensitive data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-923
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32887
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to break frequency hopping.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32888
Published: 2025-05-01
Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32889
Published: 2025-05-01
Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-32890
Published: 2025-05-01
Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. It uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-353
References: https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities; https://gotenna.com
CVE: CVE-2025-44860
Published: 2025-05-01
Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/msg_process_Port/readme.md
CVE: CVE-2025-44861
Published: 2025-05-01
Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/CloudSrvUserdataVersionCheck/readme.md
CVE: CVE-2025-44862
Published: 2025-05-01
Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/recvUpgradeNewFw/readme.md
CVE: CVE-2025-44863
Published: 2025-05-01
Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/msg_process_Url/readme.md
CVE: CVE-2025-44864
Published: 2025-05-01
Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_module/readme.md
CVE: CVE-2025-44865
Published: 2025-05-01
Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_enable/readme.md
CVE: CVE-2025-44866
Published: 2025-05-01
Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_level/readme.md
CVE: CVE-2025-44867
Published: 2025-05-01
Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetNetCheckTools/readme.md
CVE: CVE-2025-46337
Published: 2025-05-01
Description: ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426; https://github.com/ADOdb/ADOdb/issues/1070; https://github.com/ADOdb/ADOdb/security/advisories/GHSA-8x27-jwjr-8545
CVE: CVE-2025-46345
Published: 2025-05-01
Description: Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.
CWE: CWE-290
References: https://github.com/auth0-extensions/auth0-account-link-extension/pull/187; https://github.com/auth0-extensions/auth0-account-link-extension/security/advisories/GHSA-j2jh-rqff-7vmg
CVE: CVE-2025-46565
Published: 2025-05-01
Description: Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb; https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3; https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3
CVE: CVE-2025-46566
Published: 2025-05-01
Description: DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-923
References: https://github.com/dataease/dataease/security/advisories/GHSA-hxw4-vpfp-frgv; https://github.com/dataease/dataease/security/advisories/GHSA-hxw4-vpfp-frgv
CVE: CVE-2025-46567
Published: 2025-05-01
Description: LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan2.py` script of the LLaMA-Factory project. The script performs insecure deserialization using `torch.load()` on user-supplied `.bin` files from an input directory. An attacker can exploit this behavior by crafting a malicious `.bin` file that executes arbitrary commands during deserialization. This issue has been patched in version 1.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-502
References: https://github.com/hiyouga/LLaMA-Factory/commit/2989d39239d2f46e584c1e1180ba46b9768afb2a; https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-f2f7-gj54-6vpv; https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-f2f7-gj54-6vpv
CVE: CVE-2025-46568
Published: 2025-05-01
Description: Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references to several files inside, allow the attachment of content from any webpage or local file to a PDF. This allows the attacker to read any file on the server, including sensitive files and configuration files. All users utilizing this feature will be affected. This issue has been patched in version 0.45.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/Stirling-Tools/Stirling-PDF/commit/e[PII_REDACTED]cb5f9262986b3770ca592af60cda; https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-998c-x8hx-737r; https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-998c-x8hx-737r
CVE: CVE-2025-24522
Published: 2025-05-01
Description: KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-305
References: http://packages.revolutionpi.de/pool/main/p/pictory/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01
CVE: CVE-2025-32011
Published: 2025-05-01
Description: KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: http://packages.revolutionpi.de/pool/main/p/pictory/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01
CVE: CVE-2025-35975
Published: 2025-05-01
Description: MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. The user must open a malicious DCM file for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-121-01
CVE: CVE-2025-35996
Published: 2025-05-01
Description: KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-97
References: http://packages.revolutionpi.de/pool/main/p/pictory/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01
CVE: CVE-2025-36521
Published: 2025-05-01
Description: MicroDicom DICOM Viewer is vulnerable to an out-of-bounds read which may allow an attacker to cause memory corruption within the application. The user must open a malicious DCM file for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-121-01; https://www.microdicom.com/downloads.html
CVE: CVE-2025-36558
Published: 2025-05-01
Description: KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the user and be executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-97
References: http://packages.revolutionpi.de/pool/main/p/pictory/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01
CVE: CVE-2025-3517
Published: 2025-05-01
Description: Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266
References: https://devolutions.net/security/advisories/DEVO-2025-0006/
CVE: CVE-2025-4174
Published: 2025-05-01
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.306794
CVE: CVE-2025-29763
Published: 2025-05-01
Description: Rejected reason: “This CVE ID is Rejected and will not be used.  The issue was determined to not be a vulnerability.”
CVE: CVE-2025-46569
Published: 2025-05-01
Description: Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.
CWE: CWE-94, CWE-863
References: https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c; https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7
CVE: CVE-2025-46625
Published: 2025-05-01
Description: Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to the web management portal to gain root shell access to the device by sending a crafted web request. This is persistent because the command injection is saved in the configuration of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd; https://www.tendacn.com/us/default.html
CVE: CVE-2025-46626
Published: 2025-05-01
Description: Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-326
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46625-command-injection-through-setlancfg-in-httpd; https://www.tendacn.com/us/default.html
CVE: CVE-2025-46627
Published: 2025-05-01
Description: Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/octets of the MAC address.
CVSS Score: 8.2 (HIGH)
CWE: CWE-922
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46627-calculated-os-root-password; https://www.tendacn.com/us/default.html
CVE: CVE-2025-46628
Published: 2025-05-01
Description: Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46628-command-injection-through-ifconfig-command-in-ate; https://www.tendacn.com/us/default.html
CVE: CVE-2025-46629
Published: 2025-05-01
Description: Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46629-lack-of-authentication-in-ate; https://www.tendacn.com/us/default.html
CVE: CVE-2025-46630
Published: 2025-05-01
Description: Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46630-enable-ate-unauthenticated-through-httpd; https://www.tendacn.com/us/default.html