ID
VAR-202509-0004
CVE
CVE-2025-9778
TITLE
Shenzhen Tenda Technology Co.,Ltd. of W12 Vulnerability related to use of hardcoded credentials in firmware
Trust: 0.8
DESCRIPTION
A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. The manipulation leads to hard-coded credentials. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. Shenzhen Tenda Technology Co.,Ltd. of W12 A vulnerability exists in the firmware regarding the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The Tenda W12 is a dual-band gigabit wireless panel access point (AP) from Tenda Technology, designed for scenarios such as hotels, villas, and large apartments. It supports the IEEE 802.11ac protocol and the Wave2 standard, and boasts a dual-band concurrent speed of 1167Mbps. Attackers can exploit this vulnerability to obtain sensitive information
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | w12 | scope: | eq | version: | 3.0.0.6\(3948\) | Trust: 1.0 |
| vendor: | tenda | model: | w12 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | w12 | scope: | eq | version: | w12 firmware 3.0.0.6(3948) | Trust: 0.8 |
| vendor: | tenda | model: | w12 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | jixiang tengda | model: | w12 | scope: | lte | version: | <=123.0.0.63948 | Trust: 0.6 |
| vendor: | tenda | model: | w12 | scope: | lte | version: | <=3.0.0.6(3948) | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-259 | Trust: 1.0 |
| problemtype: | CWE-798 | Trust: 1.0 |
| problemtype: | Using hardcoded passwords (CWE-259) [ others ] | Trust: 0.8 |
| problemtype: | Use hard-coded credentials (CWE-798) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | Use hard-coded credentials (CWE-798) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-9778 | Trust: 3.2 |
| db: | VULDB | id: | 322080 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-013160 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-28848 | Trust: 0.6 |
REFERENCES
| url: | https://vuldb.com/?id.322080 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.640969 | Trust: 1.8 |
| url: | https://www.tenda.com.cn/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-9778 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.322080 | Trust: 1.0 |
| url: | https://github.com/august829/yu/blob/main/58ead8e7e08bfb0e8.md | Trust: 1.0 |
| url: | https://github.com/august829/yu/blob/main/58ead8e7e08bfb0e8.md#steps-to-reproduce | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2025-28848 |
| db: | JVNDB | id: | JVNDB-2025-013160 |
| db: | NVD | id: | CVE-2025-9778 |
LAST UPDATE DATE
2025-11-25T00:05:03.112000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-28848 | date: | 2025-11-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-013160 | date: | 2025-09-05T09:32:00 |
| db: | NVD | id: | CVE-2025-9778 | date: | 2025-09-04T16:19:21.700 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-28848 | date: | 2025-11-19T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-013160 | date: | 2025-09-05T00:00:00 |
| db: | NVD | id: | CVE-2025-9778 | date: | 2025-09-01T12:15:32.180 |