CVE-2025-52054

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate with network services on the device.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.virtualhackinglabs.com/advisories/cve-2025-52054-tenda-ac8-calculated-root-password/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac8:4.0:*:*:*:*:*:*:*

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Un problema fue descubierto en Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. La contraseña de root del dispositivo se calcula con una cadena estática y los últimos dos octetos de la dirección MAC del dispositivo. Esto permite a un atacante no autenticado autenticarse con los servicios de red en el dispositivo.

Information

Published : 2025-08-28 15:16

Updated : 2026-09-26 00:10

NVD link : CVE-2025-52054

Mitre link : CVE-2025-52054

CVE.ORG link : CVE-2025-52054

JSON object : View

Products Affected

tenda

ac8
ac8_firmware

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-52054", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52054", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-28T20:01:44.671287Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-08-28T15:16:00.917", "references": [{"url": "https://www.virtualhackinglabs.com/advisories/cve-2025-52054-tenda-ac8-calculated-root-password/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate with network services on the device."}, {"lang": "es", "value": "Un problema fue descubierto en Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. La contrase\u00f1a de root del dispositivo se calcula con una cadena est\u00e1tica y los \u00faltimos dos octetos de la direcci\u00f3n MAC del dispositivo. Esto permite a un atacante no autenticado autenticarse con los servicios de red en el dispositivo."}], "lastModified": "2026-09-26T00:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D4E341-C078-4BCA-9FFC-D8ECA995654F", "versionEndIncluding": "16.03.33.05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac8:4.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "655619B2-6E8B-4D2E-98E7-028E69597E80"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}