CVE-2025-70802
Received Received - Intake
Hardcoded Root Password in Tenda G1V3.1si Firmware Allows Unauthorized Access

Publication date: 2026-03-10

Last updated on: 2026-04-09

Assigner: MITRE

Description
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2025-70802
EUVD
EUVD-2025-208540
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tenda g1_firmware 16.01.7.8
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in Tenda G1V3.1si Firmware V16.01.7.8 is due to a hardcoded password found in the /etc_ro/shadow file. This flaw allows attackers to log in as the root user, giving them full administrative access to the device.

Impact Analysis

This vulnerability can have serious impacts because it allows an attacker to gain root access to the affected device. With root access, an attacker can control the device completely, potentially leading to unauthorized changes, data theft, disruption of services, or using the device as a foothold for further attacks.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart