PatchTheCVErx2 pro firmware vulnerabilities and fixes
Recent CVEs affecting rx2 pro firmware, with upgrade or downgrade steps. 11 tracked.
Also searched as: rx2profirmware.
rx2 pro firmware has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-05-01. Highest priority: CVE-2025-46631 (score 56/100).
- CVE-2025-46635 HIGH 7.1 MITIGATE An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices
- CVE-2025-46634 HIGH 8.2 MITIGATE Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14
- CVE-2025-46633 HIGH 8.2 MITIGATE Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14
- CVE-2025-46632 MEDIUM 6.5 MITIGATE Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an at
- CVE-2025-46631 MEDIUM 6.5 MITIGATE Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticat
- CVE-2025-46630 MEDIUM 6.5 MITIGATE Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticat
- CVE-2025-46629 MEDIUM 6.5 MITIGATE Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthentica
- CVE-2025-46628 HIGH 7.3 MITIGATE Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows
- CVE-2025-46627 HIGH 8.2 MITIGATE Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to
- CVE-2025-46626 HIGH 7.3 MITIGATE Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of t
- CVE-2025-46625 HIGH 8.8 MITIGATE Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.1
FAQ
How do I fix rx2 pro firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is rx2 pro firmware being exploited right now?
None of the tracked rx2 pro firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which rx2 pro firmware CVE should I patch first?
CVE-2025-46631 currently ranks highest (56/100): Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticat.