8.2
CVE-2025-46634
- EPSS 0.12%
- Veröffentlicht 01.05.2025 00:00:00
- Zuletzt bearbeitet 27.05.2025 14:18:00
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after the user has transmitted the hash of their password in cleartext. The hash can be replayed to authenticate.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tenda ≫ Rx2 Pro Firmware Version16.03.30.14
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.12% | 0.312 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.2 | 3.9 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
|
CWE-312 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.