Which versions of Tenda RP3 Pro are affected by CVE-2025-11666?

Tenda RP3 Pro routers running firmware versions up to 22.5.7.93 contain hard-coded credentials that allow authenticated administrators to bypass security controls during firmware updates, potentially…

How to fix or mitigate CVE-2025-11666?

24 hours: Audit all Tenda RP3 Pro devices in inventory and identify those running firmware versions up to 22.5.7.93; restrict administrative console access to authorized personnel only. 7 days: Implement network segmentation to limit management access to Tenda RP3 Pro devices and enforce multi-factor authentication for any administrative interfaces where supported. 30 days: Monitor vendor advisories for firmware updates addressing CVE-2025-11666; when available, upgrade all affected devices to patched firmware versions; conduct security review of administrative access policies for network infrastructure devices.

Tenda RP3 Pro CVE-2025-11666

Q: What is the CVSS score of CVE-2025-11666?

CVE-2025-11666 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Credentials Management Errors (CWE-255)

2025-10-13 cna@vuldb.com

Tenda Authentication Bypass

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:15 vuln.today

DescriptionCVE.org

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

AnalysisAI

Hard-coded credentials in Tenda RP3 Pro firmware (versions up to 22.5.7.93) allow local high-privilege attackers to bypass authentication during firmware updates via the force_upgrade.sh script. Public exploit code exists on GitHub. CVSS 7.0 (High) reflects local access requirement with high privileges, making this a lower real-world priority despite the severity rating - exploitation requires an attacker to already have administrative console access to the device.

Technical ContextAI

The vulnerability resides in force_upgrade.sh, a shell script within the Tenda RP3 Pro firmware update handler mechanism. This is classified as CWE-255 (Credentials Management Errors), specifically involving a hard-coded password accessible via the 'current_force_upgrade_pwd' parameter. Hard-coded credentials are authentication secrets embedded directly in source code or configuration files, allowing attackers who can read or manipulate the file to bypass intended authentication controls. In IoT devices like WiFi range extenders, firmware update mechanisms often use embedded credentials to validate update requests, but when these credentials are static across all devices and discoverable through reverse engineering or published exploits, they become universal bypass keys for that product line.

Affected ProductsAI

Tenda RP3 Pro WiFi range extender running firmware versions up to and including 22.5.7.93. The vulnerability affects the firmware update mechanism specifically. CPE or additional affected model variants not provided in available data. Vendor product page available at https://www.tenda.com.cn/ but no vendor security advisory identified in references.

RemediationAI

No vendor-released patch or fixed firmware version identified at time of analysis. Tenda has not published a security advisory addressing CVE-2025-11666 in available references. Compensating controls for affected deployments: (1) Restrict physical and network access to device management interfaces - disable remote administration if enabled, use firewall rules to limit access to trusted management networks only (trade-off: reduces convenience for legitimate remote management); (2) Change default administrative credentials immediately and enforce strong unique passwords (does not fix the hard-coded credential but limits initial access); (3) Monitor firmware update logs for unauthorized update attempts; (4) For high-security environments, consider replacing affected devices with models from vendors demonstrating mature secure development practices. Check vendor site https://www.tenda.com.cn/ periodically for firmware updates. Technical details and exploit available at https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.md.