{"id":"CVE-2025-46629","aliases":["EUVD-2025-13236","GHSA-f57c-fm3p-ggmf"],"status":"published","title":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an...","description":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00869,"percentile":0.59201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2025-05-01T00:00:00Z","modified":"2026-06-17T09:26:44Z","products":[{"vendor":"tenda","product":"rx2_pro_firmware"}],"references":[{"url":"https://www.tendacn.com/us/default.html","tags":["Product"]},{"url":"https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46629-lack-of-authentication-in-ate","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46629"},{"url":"https://github.com/advisories/GHSA-f57c-fm3p-ggmf"}],"sources":{"cve":[{"id":"CVE-2025-46629","description":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet","status":"published","published":"2025-05-01T00:00:00Z","modified":"2025-05-02T15:11:42.416Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-13236","description":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet","status":"published","published":"2025-05-01T00:00:00Z","modified":"2025-05-02T15:11:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:51:55.85045Z"}],"ghsa":[{"id":"GHSA-f57c-fm3p-ggmf","title":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an...","description":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet","status":"published","published":"2025-05-02T15:31:45Z","modified":"2025-05-02T18:32:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:02:06.423076Z"}],"nvd":[{"id":"CVE-2025-46629","description":"Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet","status":"published","published":"2025-05-01T20:15:38.66Z","modified":"2026-06-17T09:26:44.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}