CVE-2025-9828 MEDIUM

CVE-2025-9828: Tenda CP6 uhttp sub_2B7D04 risky encryption

Vendor Tenda
Product CP6
Weakness CWE-327 · Broken crypto
Published September 2, 2025
Last update September 2, 2025

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.

Key dates

02Disclosure timeline

September 2, 2025 CVE published
September 2, 2025 Record updated