CVE-2025-14636: tenda ax9_firmware

Vulnerability summary

CVE-2025-14636 is a medium (CVSS 6.3) vulnerability in tenda ax9_firmware. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-12-2025
   PublishedVulnerability first disclosed.
2. 24-02-2026
   Last modifiedVulnerability information updated.

Description

A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

• CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
• CWE-328Use of Weak HashThe product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).