CVE-2025-9731CWE-259CWE-798hardcoded-credentials

CVE-2025-9731

Low · published August 31, 2025

CVSS v3.1
2.5
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation causes hard-coded credentials. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.4th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2025-08-31T18:15Z
Affected products (1)
ProductVersionsFixed in
tenda/ac9_firmwareall versions—
References (6)
https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e4.md · [email protected]https://vuldb.com/?ctiid.322022 · [email protected]https://vuldb.com/?id.322022 · [email protected]https://vuldb.com/?submit.639748 · [email protected]https://www.tenda.com.cn/ · [email protected]https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e4.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 31 AUG 13:32Z
    Tenda AC9 Administrative shadow hard-coded credentials
    cvelistv5