CVE-2025-8980
Tenda G1 Firmware Update check_upload_file data authenticity
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 14, 2025
- Updated
- Aug 14, 2025
- Reserved
- Aug 13, 2025
Description
A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.5 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.6 Medium | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.8 Medium | AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
G1Tenda |
|
References
- VDB-319976 | Tenda G1 Firmware Update check_upload_file data authenticityvdb-entrytechnical-description
- VDB-319976 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #628605 | Tenda G1 V16.01.7.8(3660) CWE-327 Use of a Broken or Risky Cryptographic Algorithmthird-party-advisory
- Submit #628606 | Tenda G1 V16.01.7.8(3660) CWE-287 Improper Authentication (Duplicate)third-party-advisory
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Inte.mdpatch
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Auth.mdexploitpatch
- https://www.tenda.com.cn/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.