Tenda Smart Camera CVE-2026-19750

The SSH service on the Tenda device must be reachable by the attacker, either directly exposed to the internet or accessible from a network segment the attacker has already reached. No non-default configuration is required - the hardcoded credential is present in the baseline firmware image across all affected versions (V21 through V27 for CH, CP, and TX3). The CVSS 4.0 AC:H rating reflects the original difficulty of discovering the credential without public disclosure; the GitHub proof-of-concept removes this barrier entirely for any attacker who references it. Devices placed behind NAT without SSH port forwarding are protected from direct remote exploitation, though an attacker with LAN access or on the same subnet remains a threat. There is no user interaction required and no privilege is needed - the hardcoded credential is the authentication mechanism itself.

The CVSS 4.0 base score of 8.2 (HIGH) reflects full impact across confidentiality, integrity, and availability, moderated by AC:H (high attack complexity) which reflects the need to first discover or extract the hardcoded credential. However, the publicly available proof-of-concept on GitHub effectively collapses that complexity for any motivated actor who references the disclosure. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be precisely quantified; absent that signal, the combination of a static credential that is reusable across the entire affected product fleet, a network-exposed SSH service, and a published exploit writeup makes real-world exploitation probable for unpatched devices reachable from the internet. The vulnerability is not currently listed in CISA KEV, suggesting no confirmed mass exploitation at time of analysis - however, even a mid-sized municipal IT team in legnica deploying these cameras on a perimeter or public-safety network should treat this as urgent, given the credential cannot be rotated away without a vendor patch. The absence of a confirmed vendor fix is the most material risk amplifier and should be the primary driver of compensating control decisions.

An attacker scans internet-facing IP ranges for Tenda camera SSH banners, identifies a reachable device running firmware in the V21-V27 range, then authenticates using the static credential documented in the public GitHub proof-of-concept at https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability. Upon successful login, the attacker obtains a privileged shell on the device, enabling live video feed interception, lateral movement into the internal network segment the camera bridges, or enrollment of the device into a botnet for use in follow-on campaigns.