8.2
CVE-2025-46633
- EPSS 0.16%
- Veröffentlicht 01.05.2025 00:00:00
- Zuletzt bearbeitet 27.05.2025 14:17:34
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AES key in sent in cleartext in response to successful authentication. The IV is always EU5H62G9ICGRNI43.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tenda ≫ Rx2 Pro Firmware Version16.03.30.14
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.365 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.2 | 3.9 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
|
CWE-312 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.