CVE-2025-14636

Tenda AX9 httpd image_check weak hash

A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

Affected

Tenda · AX9

CVSS v4.0 VULDB

2.9 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 VULDB

2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2025-12-13

Updated

2026-02-24

Proof-of-concept exploits (1)

• IOTRes/IOT_Firmware_Update/blob/main/Tenda/AX9_Inte.md5★ · 2026-08-31

Security advisories

• https://vuldb.com/?id.336361
• https://vuldb.com/?submit.707213
• https://www.tenda.com.cn

References

• CVE Record
• NVD entry

Related

• CVE-2025-11666
• CVE-2025-12295
• CVE-2025-12296
• CVE-2025-8978
• CVE-2025-8979
• CVE-2025-8980