CVE-2025-4357
Published: 06 May 2025
Summary
CVE-2025-4357 is a medium-severity Injection (CWE-74) vulnerability in Tenda Rx3 Firmware. Its CVSS base score is 5.1 (Medium).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-4357 is a command injection vulnerability in the Tenda RX3 router running firmware version 16.03.13.11_multi. The flaw resides in an unknown processing routine within the /goform/telnet endpoint and is tracked under CWE-74 and CWE-77. It received a CVSS 4.0 score of 5.1 reflecting high attack complexity requirements despite network accessibility.
An authenticated remote attacker with administrative credentials can supply crafted input to the telnet form handler, resulting in arbitrary command execution on the device. Public proof-of-concept code has been released, enabling attackers to leverage the issue for unauthorized control or further lateral movement within affected networks.
No vendor advisory or patch information is provided in the available references, which include a detailed disclosure on GitHub and entries on VulDB along with a link to the Tenda support site. The associated EPSS score has remained flat at 0.0790 with no observed increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13600
Vulnerability details
A vulnerability was found in Tenda RX3 16.03.13.11_multi. It has been rated as critical. This issue affects some unknown processing of the file /goform/telnet. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been…
more
disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.