CVE-2025-70798
Received Received - Intake
Hardcoded Root Password in Tenda i24V3.0si Firmware Allows Unauthorized Access

Publication date: 2026-03-10

Last updated on: 2026-04-09

Assigner: MITRE

Description
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2025-70798
EUVD
EUVD-2025-208538
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tenda i24_firmware 3.0.0.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in Tenda i24V3.0si Firmware V3.0.0.5 is due to a hardcoded password found in the /etc_ro/shadow file. This flaw allows attackers to log in as the root user, giving them full administrative access to the device.

Impact Analysis

This vulnerability can have a severe impact because it allows unauthorized attackers to gain root access to the affected device. With root privileges, attackers can control the device completely, potentially leading to data theft, device manipulation, network compromise, or further attacks on connected systems.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart