CVE-2025-14636

low-risk
Published 2025-12-13

A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

Do I need to act?

-
0.07% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Ax9 Firmware

Affected Vendors

Tenda

References (5)

Exploit https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md
Permissions Required https://vuldb.com/?ctiid.336361
Third Party Advisory https://vuldb.com/?id.336361
Third Party Advisory https://vuldb.com/?submit.707213
Product https://www.tenda.com.cn/
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal