CVE-2025-9778: low-severity vulnerability in Tenda W12
Tenda W12 Administrative shadow hard-coded credentials
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 1.8epss 0.1%
A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. The manipulation leads to hard-coded credentials. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · W12Related CVEs — Tenda W12
In the same product, most dangerous first.
CVE-2025-3820HIGHTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowEPSS 12.7%CVE-2025-11549HIGHTenda W12 HTTP Request modules wifiMacFilterSet stack-based overflowEPSS 8.9%CVE-2025-3693HIGHTenda W12 httpd cgiWifiRadioSet stack-based overflowEPSS 7.4%CVE-2025-3802HIGHTenda W12/i24 httpd cgiPingSet stack-based overflowEPSS 1.1%CVE-2025-4007HIGHTenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflowEPSS 1.0%CVE-2025-3803HIGHTenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflowEPSS 1.0%