i24: Use of Hard-coded Password
CVE-2025-15371 is a high-severity use of hard-coded password vulnerability in i24 from Tenda, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected i24 versions: 1.0.0.35; 3.0.0.8(4008); 04.03.01.49, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of i24 you run against the affected versions below, and install the vendor's latest release.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Tenda | i24 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | 4G03 Pro | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | 4G05 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | 4G08 | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | G0-8G-PoE | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | Nova MW5G | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
| Tenda | TEG5328F | 1.0.0.35; 3.0.0.8(4008); 04.03.01.49; 04.05.01.15; 04.08.01.28; 16.01.8.5; 65.10.15.6 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (vuldb.com).
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 7.1 | High | CNA (vuldb.com) |
| CVSS 3.1 | 7.8 | High | CNA (vuldb.com) |
| CVSS 2.0 | 6.8 | Medium | CNA (vuldb.com) |
Official description
A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the component Shadow File. Such manipulation with the input Fireitup leads to hard-coded credentials. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound authentication to external components.
How developers prevent this class of flaw
- For outbound authentication: store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible.
- For inbound authentication: Rather than hard-code a default username and password for first time logins, utilize a first login mode that requires the user to enter a unique strong password.
- Perform access control checks and limit which entities can access the feature that requires the hard-coded password. For example, a feature might only be enabled through the system console instead of through a network connection.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in i24
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
Recent Use of Hard-coded Password vulnerabilities
- 9.8 Critical severity
- 8.8 High severity
- 7.3 High severity
- 8.1 High severity
- 9.8 Critical severity
- 8.0 High severity
Spotted an error? Tell us.