CVE-2025-9828CWE-327

CVE-2025-9828

Low · published September 2, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-09-02T21:15Z
Affected products (1)
ProductVersionsFixed in
tenda/cp6_firmwareall versions—
References (5)
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/CP6.md · [email protected]https://vuldb.com/?ctiid.322175 · [email protected]https://vuldb.com/?id.322175 · [email protected]https://vuldb.com/?submit.641566 · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 02 SEP 17:02Z
    Tenda CP6 uhttp sub_2B7D04 risky encryption
    cvelistv5