CVE-2025-11666
Medium
Description
A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.
SeverityMedium
CVSS6.7
Exploit probability—
ProductRP3 Pro
PublishedOct 13, 2025
First seenOct 13, 2025
Weakness typeCWE-259CWE-259CWE-255CWE-255
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Tenda RP3 Pro | 22.5.7.0, 22.5.7.1, 22.5.7.2, 22.5.7.3, 22.5.7.4, 22.5.7.5, 22.5.7.6, 22.5.7.7, 22.5.7.8, 22.5.7.9, 22.5.7.10, 22.5.7.11, 22.5.7.12, 22.5.7.13, 22.5.7.14, 22.5.7.15, 22.5.7.16, 22.5.7.17, 22.5.7.18, 22.5.7.19, 22.5.7.20, 22.5.7.21, 22.5.7.22, 22.5.7.23, 22.5.7.24, 22.5.7.25, 22.5.7.26, 22.5.7.27, 22.5.7.28, 22.5.7.29, 22.5.7.30, 22.5.7.31, 22.5.7.32, 22.5.7.33, 22.5.7.34, 22.5.7.35, 22.5.7.36, 22.5.7.37, 22.5.7.38, 22.5.7.39, 22.5.7.40, 22.5.7.41, 22.5.7.42, 22.5.7.43, 22.5.7.44, 22.5.7.45, 22.5.7.46, 22.5.7.47, 22.5.7.48, 22.5.7.49, 22.5.7.50, 22.5.7.51, 22.5.7.52, 22.5.7.53, 22.5.7.54, 22.5.7.55, 22.5.7.56, 22.5.7.57, 22.5.7.58, 22.5.7.59, 22.5.7.60, 22.5.7.61, 22.5.7.62, 22.5.7.63, 22.5.7.64, 22.5.7.65, 22.5.7.66, 22.5.7.67, 22.5.7.68, 22.5.7.69, 22.5.7.70, 22.5.7.71, 22.5.7.72, 22.5.7.73, 22.5.7.74, 22.5.7.75, 22.5.7.76, 22.5.7.77, 22.5.7.78, 22.5.7.79, 22.5.7.80, 22.5.7.81, 22.5.7.82, 22.5.7.83, 22.5.7.84, 22.5.7.85, 22.5.7.86, 22.5.7.87, 22.5.7.88, 22.5.7.89, 22.5.7.90, 22.5.7.91, 22.5.7.92, 22.5.7.93 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.