Tenda Network Devices CVE-2025-15371

Requires local access to the Tenda device with low-privilege user credentials (CVSS PR:L). Exploitation does not require specific non-default configurations-the hard-coded credentials exist in the shadow file component across default installations of affected firmware versions up to 65.10.15.6. The local attack vector (AV:L) is the primary limiting factor, requiring the attacker to have shell or console access to the device rather than exploiting remotely over the network. Physical access to the device, existing network presence with ability to reach management interfaces, or prior compromise of systems with administrative connectivity to the Tenda devices would satisfy exploitation prerequisites. User interaction is not required (UI:N).

Real-world risk is moderate and deployment-dependent. The CVSS 4.0 score of 7.1 (AV:L/AC:L/PR:L) indicates local attack vector requiring low privileges, significantly limiting exploitation scenarios compared to remote vulnerabilities. The E:P (Proof-of-concept exploit) modifier confirms public exploit availability on GitHub, reducing exploitation complexity for attackers with local access. However, no CISA KEV listing or EPSS data suggests this is not being actively exploited at scale. The primary risk exists in environments where physical security is weak, untrusted users have local shell access, or where attackers have already gained initial foothold through other means and seek privilege escalation. For SOHO and small business deployments-Tenda's target market-the local attack vector provides some natural containment, but the multiple affected product lines (seven models) expands the attack surface. The hardcoded nature (CWE-259) means credentials cannot be rotated without firmware updates, creating persistent risk until patched. Priority should be HIGH for internet-facing deployments in colocation facilities or shared office environments, MEDIUM for typical home/small office use with physical security controls.

An attacker gains local access to a Tenda device through physical proximity in a shared office environment or by compromising an adjacent system on the network that provides shell access to the device. Using the publicly available exploit code from GitHub, the attacker authenticates using hard-coded credentials embedded in the shadow file component. With authentication bypassed, the attacker gains full administrative control over the device, enabling traffic interception, network pivoting, firmware modification, or persistent backdoor installation.