What is the CVSS score of CVE-2026-38571?

CVE-2026-38571 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Tenda N300 F3 CVE-2026-38571

EUVD-2026-39936 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-06-26 mitre

GHSA-h59c-hv3v-mj8q

Tenda Authentication Bypass N A

4.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.1 MEDIUM

Physical access required (AV:P, AC:L); wr command enables arbitrary memory writes warranting I:H, correcting the NVD-provided I:N omission.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:11 vuln.today

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug console of the Tenda N300 F3 (V603) allow a physically proximate attacker to obtain stored WPA2 credentials in cleartext and to read or write arbitrary memory via the serial console.

AnalysisAI

Cleartext WPA2 credential exposure and unauthenticated arbitrary memory read/write access in the Tenda N300 F3 (V603) UART debug console allow a physically proximate attacker to extract stored Wi-Fi credentials and manipulate device memory without any authentication. The serial debug interface ships with no access controls, exposing the rr/wr memory commands to anyone with a serial adapter and brief physical access to the PCB. A proof-of-concept is documented per SSVC data, though no active exploitation is confirmed in CISA KEV, consistent with the mandatory physical access requirement.

Technical ContextAI

The Tenda N300 F3 (V603) is a consumer-grade Wi-Fi router that exposes a UART (Universal Asynchronous Receiver-Transmitter) debug console on its circuit board - a serial interface commonly left active in production embedded hardware after firmware development. In this device, the console requires no authentication and exposes rr (read memory region) and wr (write memory region) commands, enabling direct RAM manipulation without credentials. WPA2 PSK credentials are stored in cleartext in memory, which constitutes CWE-312 (Cleartext Storage of Sensitive Information). The CPE string provided (cpe:2.3:a:n/a:n/a) is a placeholder and carries no useful product metadata; the affected product is confirmed solely from the CVE description as Tenda N300 F3 firmware V603. The two weaknesses - unauthenticated debug interface and cleartext credential storage - compound each other: the debug access provides the read primitive, and cleartext storage ensures the credential is immediately usable once extracted.

RemediationAI

No vendor-released patch has been identified at time of analysis. The Tenda N300 F3 is a low-cost consumer device with uncertain firmware update cadence from the vendor. As a primary compensating control, physically block access to the UART header on the PCB by applying epoxy or a physical enclosure barrier - this eliminates the attack surface but is irreversible and may void warranty. Alternatively, restrict physical access to the device by deploying it inside locked network cabinets or secured equipment rooms, reducing the attacker population to those with authorized physical access. Network operators should immediately rotate WPA2 PSK credentials on any device that may have been physically handled by an untrusted party, since extracted credentials remain valid network entry points. Long-term, consider migrating to replacement hardware from a vendor with a documented security patching program. The vulnerability research and proof-of-concept are documented at https://github.com/ZEssaidi-CS/Vulnerability-research/tree/main/CVE-2026-38571.