EUVD-2026-58487
GHSA-2vh2-4q7p-6vxp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because SSH is a network service; AC:H reflects credential discovery requirement despite public POC; PR:N because the hardcoded password itself bypasses authentication without any prior privilege.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used.
AnalysisAI
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SSH service on the Tenda device must be reachable by the attacker, either directly exposed to the internet or accessible from a network segment the attacker has already reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.2 (HIGH) reflects full impact across confidentiality, integrity, and availability, moderated by AC:H (high attack complexity) which reflects the need to first discover or extract the hardcoded credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans internet-facing IP ranges for Tenda camera SSH banners, identifies a reachable device running firmware in the V21-V27 range, then authenticates using the static credential documented in the public GitHub proof-of-concept at https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability. Upon successful login, the attacker obtains a privileged shell on the device, enabling live video feed interception, lateral movement into the internal network segment the camera bridges, or enrollment of the device into a botnet for use in follow-on campaigns. |
| Remediation | No vendor-released patch has been identified at time of analysis; operators should monitor the Tenda vendor site at https://www.tenda.com.cn/ and the VulDB tracking entry at https://vuldb.com/vuln/389501 for firmware updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Tenda CH, CP, and TX3 devices currently deployed, identify which are internet-exposed or accessible from untrusted networks, and implement immediate network-level access restrictions (firewall rules blocking SSH/remote access). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today