CVE-2025-11666CWE-259

CVE-2025-11666

Medium · published October 13, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.5th percentile
Weakness
CWE-259 · Use of Hard-coded Password
Published
2025-10-13T11:15Z
References (5)
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.md · [email protected]https://vuldb.com/?ctiid.328085 · [email protected]https://vuldb.com/?id.328085 · [email protected]https://vuldb.com/?submit.673128 · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 13 OCT 07:02Z
    Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password
    cvelistv5