CVE-2025-5763
Last modified
CVE-2025-5763 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. EPSS estimates a 4.92% chance of exploitation in the next 30 days.
Description
A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Cp3 Firmware | 11.10.00.2311090948 |
References
- https://blog.kevgen.ru/posts/rce_in_tenda_cp3_cameraExploit, Third Party Advisory
- https://github.com/k3vg3n/researches/blob/main/RCE_in_Tenda_CP3_camera.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.311305Permissions Required
- https://vuldb.com/?id.311305Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.590784Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/Product
- https://github.com/k3vg3n/researches/blob/main/RCE_in_Tenda_CP3_camera.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5763?
How severe is CVE-2025-5763?
How do I fix CVE-2025-5763?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-57618A path traversal vulnerability in FastX3 thru 3.3.67 allows …7.3
- CVE-2025-5762A vulnerability, which was classified as critical, was found…7.5
- CVE-2025-57622An issue in Step-Video-T2V allows a remote attacker to execu…9.8
- CVE-2025-57623A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0…5.3
- CVE-2025-57624A DLL hijacking vulnerability in CYRISMA Agent before 444 al…7.8
- CVE-2025-57625CYRISMA Sensor before 444 for Windows has an Insecure Folder…8.8
- CVE-2025-57631SQL Injection vulnerability in TDuckCloud v.5.1 allows a rem…9.8
- CVE-2025-57632libsmb2 6.2+ is vulnerable to Buffer Overflow. When processi…7.5
- CVE-2025-57633A command injection vulnerability in FTP-Flask-python throug…9.8
- CVE-2025-57636OS Command injection vulnerability in D-Link C1 2020-02-21. …6.5
- CVE-2025-57637Buffer overflow vulnerability in D-Link DI-7100G 2020-02-21 …7.5
- CVE-2025-57638Buffer overflow vulnerability in Tenda AC9 1.0 via the user …7.5
Are you affected by CVE-2025-5763?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST