Hard-Coded Credentials Vulnerability in Tenda W12 Administrative Interface
CVE-2025-9778

1.8LOW

Key Information:

Vendor: Tenda
Status: W12
Vendor: CVE Published:; 1 September 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-9778?

A security vulnerability has been identified in the Tenda W12 model, notably within the Administrative Interface. The issue centers around hard-coded credentials found in the /etc_ro/shadow file, which can potentially lead to unauthorized access. Although the attack must be executed locally and the method requires a certain level of expertise, the public disclosure of the exploit increases the urgency for users to address the security shortcomings in their systems.

Affected Version(s)

W12 1.0.0.1(5411)

W12 1.0.0.5(9419)

W12 2.0.0.3(8326)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-9778 - Proof of Concept