Tenda RP3 Pro CVE-2025-11666

Requires local access to the Tenda RP3 Pro device with high-privilege (administrative) credentials already obtained. The attacker must be able to interact with the force_upgrade.sh script in the firmware update handler, which typically requires authenticated access to the device's management interface or console. This is NOT a remote unauthenticated vulnerability - the hard-coded credential issue can only be exploited after the attacker has already compromised administrative access through other means. Exploitation is limited to scenarios where an attacker has physical access to the device or has previously compromised admin credentials via default passwords, credential stuffing, or other vulnerabilities. The local attack vector (AV:L) and high privilege requirement (PR:H) are the primary limiting factors.

Real-world risk is MODERATE despite the 7.0 CVSS score. The CVSS vector (AV:L/AC:L/PR:H) reveals critical limitations: Local access vector means the attacker must already have physical or console access to the device, and High privileges required (PR:H) indicates administrative credentials are a prerequisite. This significantly reduces the attack surface compared to remotely exploitable vulnerabilities. The public exploit (E:P) on GitHub lowers the skill barrier for attackers who have already compromised the device, but does not enable initial access. No EPSS data provided, but the local+high-privilege combination typically results in <5% exploitation probability. Not listed in CISA KEV, suggesting no evidence of widespread active exploitation. Primary risk scenario: An attacker with existing administrative access (e.g., via default credentials or prior vulnerability) could use this to persist access or install malicious firmware that survives factory resets. For internet-facing deployments, this is a post-exploitation persistence technique rather than an initial entry vector.

An attacker who has already gained administrative access to a Tenda RP3 Pro device (via default credentials, phishing, or prior vulnerability) accesses the device's command-line interface locally or through an authenticated web session. Using the publicly available exploit code from GitHub, the attacker manipulates the 'current_force_upgrade_pwd' parameter in the force_upgrade.sh script to bypass authentication checks, then uploads and installs malicious firmware that includes a persistent backdoor surviving factory resets.