CVE-2025-52364

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52364
Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are present

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cybermaya.in/posts/Post-40/ Exploit Third Party Advisory
https://www.tendacn.com/product/download/cp3pro.html Broken Link
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:cp3_pro_firmware:22.5.4.93:*:*:*:*:*:*:*
cpe:2.3:h:tenda:cp3_pro:-:*:*:*:*:*:*:*
History

07 Aug 2025, 18:02

Type Values Removed Values Added
References () https://cybermaya.in/posts/Post-40/ - () https://cybermaya.in/posts/Post-40/ - Exploit, Third Party Advisory
References () https://www.tendacn.com/product/download/cp3pro.html - () https://www.tendacn.com/product/download/cp3pro.html - Broken Link
CPE cpe:2.3:h:tenda:cp3_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:cp3_pro_firmware:22.5.4.93:*:*:*:*:*:*:*
First Time Tenda
Tenda cp3 Pro Firmware
Tenda cp3 Pro

14 Jul 2025, 17:15

Type Values Removed Values Added
References
  • () https://cybermaya.in/posts/Post-40/ -

10 Jul 2025, 13:17

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de permisos inseguros en el firmware Tenda CP3 Pro V22.5.4.93 permite el servicio Telnet (telnetd) por defecto durante el arranque mediante el script de inicialización /etc/init.d/eth.sh. Esto permite a atacantes remotos conectarse al shell del dispositivo a través de la red, posiblemente sin autenticación si existen credenciales predeterminadas o débiles.

09 Jul 2025, 21:15

Type Values Removed Values Added
CWE CWE-1391
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

09 Jul 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-09 15:15

Updated : 2025-08-07 18:02

NVD link : CVE-2025-52364

Mitre link : CVE-2025-52364

CVE.ORG link : CVE-2025-52364

JSON object : View

Products Affected

tenda

  • cp3_pro
  • cp3_pro_firmware
CWE
CWE-1391

Use of Weak Credentials