What is the CVSS score of CVE-2025-5864?

CVE-2025-5864 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-5864?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

TDSEE App CVE-2025-5864

EUVD-2025-17432 LOW

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2025-06-09 cna@vuldb.com

Information Disclosure Tenda

2.9

CVSS 4.0 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reconnaissance (obtain phone number)
Delivery

Initiate password reset
Exploit

Brute-force SMS confirmation code
Execution

Reset password
Persist

Account takeover
Impact

Access device management

Vulnerability Assessment

Weakness	CWE CWE-307 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Exploitation Conditions	The attacker must know the target's phone number associated with the TDSEE App account. The attack is remote and unauthenticated, but requires high complexity due to the need to guess a multi-digit SMS code within a limited window. No special configuration is required; the vulnerability exists in default app behavior.
Impact	CVSS 4.0 base score 2.9 (Low) with AV:N/AC:H/PR:N/UI:N, indicating remote unauthenticated attack but high complexity. EPSS score 0.08% (low probability of exploitation). Public exploit code exists but no KEV listing. The high attack complexity and low EPSS suggest limited real-world risk, though the impact of account takeover could be significant for affected users.
Exploit ScenarioDerived	An attacker with knowledge of a target's phone number initiates a password reset, then brute-forces the SMS confirmation code using the public exploit. Successful exploitation allows the attacker to reset the password and take over the account, gaining access to the Tenda device management.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 26, 2026

Improper restriction of excessive authentication attempts in Tenda TDSEE App up to 1.7.12 allows remote attackers to brute-force password reset confirmation codes, potentially leading to account takeover. A public exploit exists, but exploitation is difficult due to high attack complexity. No active exploitation in CISA KEV.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 19:21 CVSS 3.7

RemediationAI

Upgrade to Tenda TDSEE App version 1.7.15 or later, as recommended by the vendor. No workarounds are documented; users should ensure the app is updated via official app stores. Monitor vendor advisories at https://www.tenda.com.cn/.

Affected VersionsENISA

TDSEE App 1.7.7

TDSEE App 1.7.11

TDSEE App 1.7.9

TDSEE App 1.7.5

TDSEE App 1.7.4

TDSEE App 1.7.1

TDSEE App 1.7.3

TDSEE App 1.7.2

TDSEE App 1.7.8

TDSEE App 1.7.12

TDSEE App 1.7.0

TDSEE App 1.7.10

TDSEE App 1.7.6

Affected Packages

euvd tdsee_app no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the password reset confirmation code handler at /app/ConfirmSmsCode. CWE-307 (Improper Restriction of Excessive Authentication Attempts) indicates the app fails to limit the number of attempts to guess the SMS confirmation code, enabling brute-force attacks. The affected product is a mobile application for Tenda network devices, used for device management and configuration.

Know when Tenda gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

vuln.today AI 3.7 LOW

Remote attack, high complexity, no privileges, no user interaction, low confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.7 (LOW) 2.9 (LOW)

CVE Published

Jun 09, 2025 - 06:15 nvd

LOW 3.7

DescriptionCVE.org

A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /app/ConfirmSmsCode of the component Password Reset Confirmation Code Handler. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.15 is able to address this issue. It is recommended to upgrade the affected component.

Executive ViewAI

Why It Matters

CVE-2025-5864 is a low-severity vulnerability in Tenda TDSEE App (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.1%

Top 77% exploitable

Prevalence

Medium

Tenda is a popular networking vendor, but app usage is moderate.

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +14

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.