CVE-2025-46626 Weak cryptography in n/a
Attackers can decrypt, replay, or forge traffic to the management service due to static AES keys and IVs, compromising router security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46626?
CVE-2025-46626 is a high-severity vulnerability in n/a, published on 1 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.
Weakness: CWE-326
Which versions are affected by CVE-2025-46626?
It affects 1 product.
Products include Tenda Rx2 Pro Firmware.
How do I fix CVE-2025-46626?
No fix has been published for CVE-2025-46626 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-46626 being exploited?
There is no known exploitation of CVE-2025-46626 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gc4p-7qxx-hhrw.