CVE-2025-9731 LOW

CVE-2025-9731: Tenda AC9 Administrative shadow hard-coded credentials

Vendor Tenda
Product AC9
Weakness CWE-798 · Hardcoded credentials
Published August 31, 2025
Last update September 2, 2025
View on NVD All CVEs

CVSS base score

2.0/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation causes hard-coded credentials. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized.

Key dates

02Disclosure timeline

August 31, 2025 CVE published
September 2, 2025 Record updated