CVE-2025-52364
Last modified
CVE-2025-52364 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are present. EPSS estimates a 0.51% chance of exploitation in the next 30 days.
Description
Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are present
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Cp3 Pro Firmware | 22.5.4.93 |
References
- https://cybermaya.in/posts/Post-40/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-52364?
How severe is CVE-2025-52364?
How do I fix CVE-2025-52364?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-52358A cross-site scripting vulnerability in Vivaldi United Group…6.3
- CVE-2025-5236The NinjaTeam Chat for Telegram plugin for WordPress is vuln…5.4
- CVE-2025-52360A Cross-Site Scripting (XSS) vulnerability exists in the OPA…8.8
- CVE-2025-52361Insecure permissions in the script /etc/init.d/lighttpd in A…7.8
- CVE-2025-52362Server-Side Request Forgery (SSRF) vulnerability exists in t…9.1
- CVE-2025-52363Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root …6.8
- CVE-2025-52365A command injection vulnerability in the szc script of the c…7.8
- CVE-2025-52367Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC …5.4
- CVE-2025-5237The Target Video Easy Publish plugin for WordPress is vulner…6.4
- CVE-2025-52372An issue in hMailServer v.5.8.6 allows a local attacker to o…5.1
- CVE-2025-52373Use of hardcoded cryptographic key in BlowFish.cpp in hMailS…4.6
- CVE-2025-52374Use of hardcoded cryptographic key in Encryption.cs in hMail…4.6
Are you affected by CVE-2025-52364?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST