CVE-2025-9828
Last modified
CVE-2025-9828 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Cp6 Firmware | 11.10.00.243 |
References
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/CP6.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.322175Permissions Required, VDB Entry
- https://vuldb.com/?id.322175Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.641566Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-9828?
How severe is CVE-2025-9828?
How do I fix CVE-2025-9828?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-9821SummaryUsers with webhook permissions can conduct SSRF via w…2.7
- CVE-2025-9822SummaryA user with administrator rights can change the confi…5.5
- CVE-2025-9823SummaryA Cross-Site Scripting (XSS) vulnerability allows an …4.8
- CVE-2025-9824ImpactThe attacker can validate if a user exists by checking…5.9
- CVE-2025-9825GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
- CVE-2025-9826Stored cross-site scripting vulnerability in M-Files Hubshar…5.4
- CVE-2025-9829A vulnerability was identified in PHPGurukul Beauty Parlour …9.8
- CVE-2025-9830A security flaw has been discovered in PHPGurukul Beauty Par…9.8
- CVE-2025-9831A weakness has been identified in PHPGurukul Beauty Parlour …9.8
- CVE-2025-9832A security vulnerability has been detected in SourceCodester…9.8
- CVE-2025-9833A vulnerability was detected in SourceCodester Online Farm M…9.8
- CVE-2025-9834A flaw has been found in PHPGurukul Small CRM 4.0. Affected …5.4
Are you affected by CVE-2025-9828?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST