CVE-2025-9309CWE-259CWE-798

Tenda AC10 MD5 Hash shadow hard-coded credentials

Low · published August 21, 2025

CVSS v4.0
2.0
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made public and could be used.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00223 · 12.2th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2025-08-21T16:32Z
EPSS history
Timeline
  • 21 AUG 16:32Z
    Tenda AC10 MD5 Hash shadow hard-coded credentials
    cvelistv5