Tenda AX9 CVE-2025-14636

Exploitation requires high complexity and specific conditions: the attacker must have network access to the AX9 device, must be able to predict or collide the weak hash algorithm used by image_check, and must be able to deliver a crafted firmware image during an update window or intercept the firmware update process. The vulnerability is not exploitable against a device in normal operating state without triggering a firmware update. Importantly, the attack does not grant unauthenticated remote code execution or device control - it compromises firmware integrity validation specifically. Default Tenda AX9 configurations are vulnerable if firmware updates are allowed from untrusted networks.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 4.0 vector shows AV:N (network-accessible) but AC:H (high complexity) combined with E:P (exploit code exists), creating a contradiction between accessibility and practical exploitation difficulty - the description explicitly states 'exploitability is difficult.' The EPSS score of 0.08% (24th percentile) confirms low exploitation probability in the wild. The integrity impact is rated at L (low), and scope is unchanged (attacker cannot escalate beyond the firmware validation context). While a publicly available POC exists, the high-complexity attack prerequisites and low information-disclosure impact mean defenders should prioritize patching higher-CVSS or actively-exploited vulnerabilities first. However, the use of weak hashing in firmware verification is a fundamental security control failure that warrants remediation in patch cycles.

An attacker on the network observes or captures a legitimate Tenda AX9 firmware update image and analyzes the weak hash algorithm used by the image_check function. Using publicly available POC code, the attacker crafts a malicious firmware image with a hash collision or predictable hash value that passes the weak validation. When the attacker can influence the firmware update mechanism (e.g., via ARP spoofing or compromised update server), they supply the malicious image to the device, which is accepted due to the hash bypass, leading to disclosure of firmware validation internals.