CVE-2025-11666

Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password

State: Published
Severity: 8.4 High
Published: Oct 13, 2025
Updated: Oct 14, 2025
Reserved: Oct 12, 2025

Description

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	6.7 Medium	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:L/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-259 Use of Hard-coded Password
CWE-255 Credentials Management

Affected Products

Product	Versions
RP3 ProTenda	22.5.7.0Affected 22.5.7.1Affected 22.5.7.2Affected 22.5.7.3Affected 22.5.7.4Affected 22.5.7.5Affected 22.5.7.6Affected 22.5.7.7Affected 22.5.7.8Affected 22.5.7.9Affected 22.5.7.10Affected 22.5.7.11Affected 22.5.7.12Affected 22.5.7.13Affected 22.5.7.14Affected 22.5.7.15Affected 22.5.7.16Affected 22.5.7.17Affected 22.5.7.18Affected 22.5.7.19Affected 22.5.7.20Affected 22.5.7.21Affected 22.5.7.22Affected 22.5.7.23Affected 22.5.7.24Affected and 69 more versions

Product

Versions

RP3 ProTenda

22.5.7.0Affected
22.5.7.1Affected
22.5.7.2Affected
22.5.7.3Affected
22.5.7.4Affected
22.5.7.5Affected
22.5.7.6Affected
22.5.7.7Affected
22.5.7.8Affected
22.5.7.9Affected
22.5.7.10Affected
22.5.7.11Affected
22.5.7.12Affected
22.5.7.13Affected
22.5.7.14Affected
22.5.7.15Affected
22.5.7.16Affected
22.5.7.17Affected
22.5.7.18Affected
22.5.7.19Affected
22.5.7.20Affected
22.5.7.21Affected
22.5.7.22Affected
22.5.7.23Affected
22.5.7.24Affected
and 69 more versions

References

VDB-328085 | Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordvdb-entrytechnical-description
VDB-328085 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #673128 | Tenda RP3 Pro V22.5.7.93 CWE-287 Improper Authenticationthird-party-advisory
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.mdexploitpatch
https://www.tenda.com.cn/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.