CVE-2025-46628: Tenda RX2 Pro Firmware

High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days.

Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed.

Affected products

• Tenda RX2 Pro Firmware: version 16.03.30.14 only

Published 2025-05-01. Last modified 2026-06-17.