CVE-2025-46635: Tenda RX2 Pro Auth Bypass Vulnerability

CVE-2025-46635 Overview

CVE-2025-46635 affects Tenda RX2 Pro routers running firmware version 16.03.30.14. The vulnerability stems from improper network isolation between the guest Wi-Fi network and other network interfaces on the router. An attacker authenticated to the guest Wi-Fi can bypass segmentation by assigning a static IP address within a non-guest subnet to their host. This grants unauthorized access to router resources and devices on internal networks that the guest network should isolate. The flaw is classified under CWE-284: Improper Access Control and impacts the confidentiality of internal network resources.

Critical Impact
Guest Wi-Fi users can pivot into private network segments and access internal devices and router administration resources without additional authentication.

Affected Products

Tenda RX2 Pro hardware (all units running the affected firmware)
Tenda RX2 Pro Firmware version 16.03.30.14
Networks relying on the device's guest Wi-Fi segmentation for isolation

Discovery Timeline

2025-05-01 - CVE-2025-46635 published to NVD
2025-05-27 - Last updated in NVD database

Technical Details for CVE-2025-46635

Vulnerability Analysis

The Tenda RX2 Pro router exposes a guest Wi-Fi service intended to be logically separated from the primary LAN and management interfaces. The firmware fails to enforce this segmentation at the network layer. Instead of restricting guest clients to their assigned subnet through filtering rules, the router routes traffic based on destination address without verifying the source interface and subnet pairing.

An authenticated guest Wi-Fi client can manually configure a static IP address belonging to the internal LAN subnet. The router accepts and forwards traffic from this reconfigured client as if it originated from a trusted internal host. This allows the attacker to reach the router's administrative interfaces, internal services, and devices connected to other network segments.

Root Cause

The root cause is missing access control enforcement between network interfaces. The firmware does not bind clients to their issued DHCP scope or apply egress filtering that ties source IP addresses to the wireless SSID of origin. The guest virtual interface lacks the firewall rules required to drop packets destined for non-guest subnets.

Attack Vector

Exploitation requires the attacker to authenticate to the guest Wi-Fi network using the shared guest credentials. Once connected, the attacker disables DHCP on their client and assigns a static IPv4 address inside the internal LAN range, with a matching subnet mask and the router's internal interface as the default gateway. Traffic from the attacker host is then forwarded across the segmentation boundary, reaching internal hosts and the router administration plane.

No memory corruption, authentication bypass against the management interface, or specialized tooling is required. The attack reduces to standard host network reconfiguration available in any operating system.

Detection Methods for CVE-2025-46635

Indicators of Compromise

Guest Wi-Fi clients communicating with IP addresses outside the assigned guest DHCP scope.
ARP table entries on internal hosts showing MAC addresses associated with guest network clients.
Authentication attempts against the router administrative interface originating from guest SSID clients.
Unexpected traffic flows between the guest virtual interface and internal LAN subnets in router flow logs.

Detection Strategies

Monitor router syslog and flow data for source IP addresses that do not match the DHCP lease issued to the connecting MAC address.
Inspect wireless association logs alongside DHCP and ARP records to identify clients using static addressing on the guest SSID.
Deploy network sensors that correlate the wireless SSID of origin with the IPv4 source address observed on uplinks.

Monitoring Recommendations

Enable verbose logging on the Tenda RX2 Pro and forward events to a centralized log platform for correlation.
Track east-west traffic between guest and internal subnets, alerting on any non-zero volume.
Audit ARP and neighbor caches on internal servers for entries sourced from guest-side MAC address ranges.

How to Mitigate CVE-2025-46635

Immediate Actions Required

Disable the guest Wi-Fi feature on the Tenda RX2 Pro until a vendor patch is verified to remediate the isolation flaw.
Move sensitive devices and management interfaces to a separate VLAN reachable only through a properly segmented switch or upstream firewall.
Restrict administrative access to the router so it is reachable only from a dedicated management host on the wired LAN.

Patch Information

No vendor advisory or fixed firmware version is listed in the NVD record at the time of publication. Monitor the Tenda Official Website for firmware updates addressing CVE-2025-46635. Related Tenda research is documented in the UTurn Blog Tenda Writeup.

Workarounds

Replace the built-in guest Wi-Fi with an isolated SSID on a dedicated access point connected to a firewalled VLAN.
Enforce inbound access control lists on the upstream router or firewall that drop traffic from guest MAC addresses to internal subnets.
Apply static ARP entries and port-based isolation on managed switches to limit lateral movement from the guest segment.
Rotate guest Wi-Fi credentials frequently and limit guest network availability to required hours only.

bash

# Example upstream firewall rule (iptables) blocking guest-to-internal traffic
# Assumes guest subnet 192.168.10.0/24 and internal subnet 192.168.1.0/24
iptables -I FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -j DROP
iptables -I FORWARD -s 192.168.10.0/24 -d 192.168.1.1 -j DROP