CVE-2025-11666

MediumCVSS 6.7/10Last modified Oct 8, 2026

Description

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255 CWE-259

Affected software

Vendor	Product	Versions
Tenda	RP3 Pro	22.5.7.0; 22.5.7.1; 22.5.7.2; 22.5.7.3; 22.5.7.4; 22.5.7.5; 22.5.7.6; 22.5.7.7; 22.5.7.8; 22.5.7.9; 22.5.7.10; 22.5.7.11; 22.5.7.12; 22.5.7.13; 22.5.7.14; 22.5.7.15; 22.5.7.16; 22.5.7.17; 22.5.7.18; 22.5.7.19

References

Timeline

Published: Oct 13, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-116678.8A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the fi CVE-2025-116687.2A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the fil CVE-2025-116698.1Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 ar CVE-2025-11679.8A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is so CVE-2025-116704.3Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by t CVE-2025-116715.3Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attacker CVE-2025-116725.3Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attacker CVE-2025-116737.2SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functiona CVE-2025-116746.8SOOP-CLM developed by PiExtract has a Server-Side Request Forgery vulnerability, allowing privileged remote attackers to read server files o CVE-2025-116757.2Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and CVE-2025-116767.1Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers CVE-2025-116776.3Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific config