Tenda AC10 CVE-2026-19924

The Tenda AC10 httpd web management interface must be network-reachable by the attacker. The CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:N/UI:N confirms no special conditions - unauthenticated remote exploitation against the default web management interface of Tenda AC10 firmware 16.03.10.09_multi_TDE01. No privileged account, no specific non-default feature activation, and no user interaction are required. The primary real-world limiting factor is WAN exposure: routers with the management interface bound to or forwarded from the WAN interface are directly exploitable from the internet, while devices where management is restricted to LAN-only access limit the attack to network-adjacent or post-initial-access scenarios. No non-default configuration is needed to be vulnerable, as the httpd service and R7WebsSecurityHandler run as part of the standard firmware web management stack.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and threat metric E:P (proof-of-concept exploit exists) confirms a high-severity, remotely exploitable, unauthenticated flaw with a publicly known exploit - even a mid-sized municipal IT team in sopot managing consumer-grade edge routers should treat this as urgent given the trivial exploitation path and full-impact outcome. EPSS data was not provided in the available intelligence, so a quantitative exploitation probability cannot be stated; however, the combination of network-accessible attack surface, zero authentication requirement, low complexity, and a public GitHub PoC creates conditions highly favorable to opportunistic and scripted mass-exploitation campaigns. The absence of a CISA KEV listing means active exploitation is not officially confirmed at time of analysis, and the distinction between publicly available exploit code and confirmed in-the-wild exploitation is maintained here. No conflicts between the CVSS vector and the description exist - both consistently indicate an unauthenticated, network-reachable attack with no configuration prerequisites beyond the management interface being reachable. The restricted scope metrics SC:N/SI:N/SA:N indicate the impact is contained to the router itself, though full administrative compromise of a network gateway carries significant downstream implications for LAN-side assets.

An unauthenticated attacker with network access to the Tenda AC10's web management interface sends a specially crafted HTTP request that exploits the flawed authentication logic in R7WebsSecurityHandler, receiving an authenticated session or direct administrative access without supplying valid credentials. A publicly available proof-of-concept at https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md demonstrates the technique, meaning the attack requires minimal adaptation and can be scripted for mass scanning. With administrative access to the router, the attacker can modify DNS settings to redirect victim traffic, replace firmware with a backdoored image, exfiltrate Wi-Fi credentials, or use the device as a persistent pivot point into the internal LAN.