What is CVE-2025-46634?

CVE-2025-46634 is a high-severity vulnerability in Tenda Rx2 Pro, classified under Cleartext Storage of Sensitive Information. CVSS score: 8.2/10. Published 2025-05-01.

How severe is CVE-2025-46634?

High severity. CVSS v3 base score is 8.2 out of 10.

Is CVE-2025-46634 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Tenda Rx2 Pro

CVE-2025-46634

Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after the user has transmitted the hash of their password in cleartext. The hash can be replayed to authenticate.

EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Tenda Rx2_pro
Tenda Rx2_pro_firmware — versions 16.03.30.14
N/a — versions n/a

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-46634?: CVE-2025-46634 is a high-severity vulnerability in Tenda Rx2 Pro, classified under Cleartext Storage of Sensitive Information. CVSS score: 8.2/10. Published 2025-05-01.
How severe is CVE-2025-46634?: High severity. CVSS v3 base score is 8.2 out of 10.
Is CVE-2025-46634 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.