Vulnerability · Published Dec 13, 2025 · Assigned by VulDB

CVE-2025-14636Tenda AX9 httpd image_check weak hash

Low 3.7

In plain English

A low-severity broken cryptography in AX9 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
Tenda	AX9	22.03.01.46

Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-336361 | Tenda AX9 httpd image_check weak hash vdb-entry, technical-description
VDB-336361 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #707213 | Tenda AX9 V22.03.01.46 CWE-327 Use of a Broken or Risky Cryptographic Algorithm third-party-advisory
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md exploit, patch
https://www.tenda.com.cn/ product