CVE-2025-14636 MEDIUM

CVE-2025-14636: Tenda AX9 httpd image_check weak hash

Vendor Tenda
Product AX9
Weakness CWE-328 · Weak hash
Published December 13, 2025
Last update February 24, 2026

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.

Key dates

02Disclosure timeline

December 13, 2025 CVE published
February 24, 2026 Record updated