Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/octets of the MAC address.
Weakness
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rx2_pro_firmware | Tenda | 16.03.30.14 (including) | 16.03.30.14 (including) |