CVE-2025-70798
Received Received - Intake

Hardcoded Root Password in Tenda i24V3.0si Firmware Allows Unauthorized Access

Publication date: 2026-03-10

Last updated on: 2026-04-09

Assigner: MITRE

Description
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-10
Last Modified
2026-04-09
Generated
2026-07-06
AI Q&A
2026-03-10
EPSS Evaluated
2026-07-05
NVD
CVE-2025-70798
EUVD
EUVD-2025-208538

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda i24_firmware 3.0.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Tenda i24V3.0si Firmware V3.0.0.5 is due to a hardcoded password found in the /etc_ro/shadow file. This flaw allows attackers to log in as the root user, giving them full administrative access to the device.

Impact Analysis

This vulnerability can have a severe impact because it allows unauthorized attackers to gain root access to the affected device. With root privileges, attackers can control the device completely, potentially leading to data theft, device manipulation, network compromise, or further attacks on connected systems.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart