Search
Find a vulnerability
Search criteria
1 vulnerability found for G1 by Tenda
CVE-2025-8980 (GCVE-0-2025-8980)
Vulnerability from cvelistv5 – Published: 2025-08-14 19:32 – Updated: 2025-08-14 19:50
VLAI
EPSS
VEX
Title
Tenda G1 Firmware Update check_upload_file data authenticity
Summary
A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-14 19:50 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.319976 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.319976 | signaturepermissions-required |
| https://vuldb.com/?submit.628605 | third-party-advisory |
| https://vuldb.com/?submit.628606 | third-party-advisory |
| https://github.com/IOTRes/IOT_Firmware_Update/blo… | patch |
| https://github.com/IOTRes/IOT_Firmware_Update/blo… | exploitpatch |
| https://www.tenda.com.cn/ | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8980",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T19:50:19.243178Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T19:50:34.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Firmware Update Handler"
],
"product": "G1",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.01.7.8(3660)"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "IOT_Res (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es geht hierbei um die Funktion check_upload_file der Komponente Firmware Update Handler. Durch Manipulieren mit unbekannten Daten kann eine insufficient verification of data authenticity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T19:32:10.524Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-319976 | Tenda G1 Firmware Update check_upload_file data authenticity",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.319976"
},
{
"name": "VDB-319976 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.319976"
},
{
"name": "Submit #628605 | Tenda G1 V16.01.7.8(3660) CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.628605"
},
{
"name": "Submit #628606 | Tenda G1 V16.01.7.8(3660) CWE-287 Improper Authentication (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.628606"
},
{
"tags": [
"patch"
],
"url": "https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Inte.md"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Auth.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-08-13T18:52:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G1 Firmware Update check_upload_file data authenticity"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-8980",
"datePublished": "2025-08-14T19:32:10.524Z",
"dateReserved": "2025-08-13T16:47:34.074Z",
"dateUpdated": "2025-08-14T19:50:34.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}