Rx2 Pro Firmware vulnerabilities
7 known vulnerabilities in Rx2 Pro Firmware from Tenda. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Rx2 Pro Firmware: Improper Access Control
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the router a
- 8.2 High severity
Rx2 Pro Firmware: Cleartext Storage of Sensitive Information
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It imple
- 8.2 High severity
Rx2 Pro Firmware: Cleartext Storage of Sensitive Information
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AE
- 7.3 High severity
Rx2 Pro Firmware: Improper Access Control
Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authe
- 8.2 High severity
Rx2 Pro Firmware: Insecure Storage of Sensitive Information
Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/octets
- 7.3 High severity
Rx2 Pro Firmware: Inadequate Encryption Strength
Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.
- 8.8 High severity
Rx2 Pro Firmware: Improper Neutralization of Special Elements used in a Command
Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to the web management portal to gain root shell access to the device by sending a crafted web request. T