Tenda RP3 Pro CVE-2025-11666
HIGHCVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionNVD
A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.
AnalysisAI
Hard-coded credentials in Tenda RP3 Pro firmware (versions up to 22.5.7.93) allow local high-privilege attackers to bypass authentication during firmware updates via the force_upgrade.sh script. Public exploit code exists on GitHub. CVSS 7.0 (High) reflects local access requirement with high privileges, making this a lower real-world priority despite the severity rating - exploitation requires an attacker to already have administrative console access to the device.
Technical ContextAI
The vulnerability resides in force_upgrade.sh, a shell script within the Tenda RP3 Pro firmware update handler mechanism. This is classified as CWE-255 (Credentials Management Errors), specifically involving a hard-coded password accessible via the 'current_force_upgrade_pwd' parameter. Hard-coded credentials are authentication secrets embedded directly in source code or configuration files, allowing attackers who can read or manipulate the file to bypass intended authentication controls. In IoT devices like WiFi range extenders, firmware update mechanisms often use embedded credentials to validate update requests, but when these credentials are static across all devices and discoverable through reverse engineering or published exploits, they become universal bypass keys for that product line.
Affected ProductsAI
Tenda RP3 Pro WiFi range extender running firmware versions up to and including 22.5.7.93. The vulnerability affects the firmware update mechanism specifically. CPE or additional affected model variants not provided in available data. Vendor product page available at https://www.tenda.com.cn/ but no vendor security advisory identified in references.
RemediationAI
No vendor-released patch or fixed firmware version identified at time of analysis. Tenda has not published a security advisory addressing CVE-2025-11666 in available references. Compensating controls for affected deployments: (1) Restrict physical and network access to device management interfaces - disable remote administration if enabled, use firewall rules to limit access to trusted management networks only (trade-off: reduces convenience for legitimate remote management); (2) Change default administrative credentials immediately and enforce strong unique passwords (does not fix the hard-coded credential but limits initial access); (3) Monitor firmware update logs for unauthorized update attempts; (4) For high-security environments, consider replacing affected devices with models from vendors demonstrating mature secure development practices. Check vendor site https://www.tenda.com.cn/ periodically for firmware updates. Technical details and exploit available at https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.md.
Share
External POC / Exploit Code
Leaving vuln.today