CVE-2025-46632

6.5 mediumEPSS 0.3%

Medium (6.5) in tenda rx2 pro firmware. EPSS 0.3% chance of exploitation in the next 30 days.

Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-323
Published: 2025-05-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tenda:rx2_pro_firmware

References

https://blog.uturn.dev/#/writeups/iot-village/tenda-rx2pro/README?id=cve-2025-46632-static-iv-use-in-httpd
https://www.tendacn.com/us/default.html

Check your stack JSON