CVE-2025-9806CWE-259CWE-798hardcoded-credentials

CVE-2025-9806

Low · published September 2, 2025

CVSS v3.1
1.9
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
1.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2025-09-02T05:15Z
Affected products (3)
ProductVersionsFixed in
tenda/f1202_firmwareall versions—
tenda/f1202_firmwareall versions—
tenda/f1202_firmwareall versions—
References (6)
https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md · [email protected]https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md#steps-to-reproduce · [email protected]https://vuldb.com/?ctiid.322130 · [email protected]https://vuldb.com/?id.322130 · [email protected]https://vuldb.com/?submit.640980 · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 02 SEP 00:32Z
    Tenda F1202 Administrative shadow hard-coded credentials
    cvelistv5