Tenda N300 F3 CVE-2026-38571

Physical proximity to the Tenda N300 F3 device and direct hardware access to the UART debug pins on the PCB are required, along with a USB-to-TTL serial adapter and a serial terminal application. No authentication is required on the UART console - the rr and wr commands are accessible without any login mechanism, which is the core flaw per the CVE description. Exploitation is limited by: (1) mandatory physical access to the specific device unit, (2) ability to open or access the router casing to reach the PCB UART header, and (3) basic embedded hardware knowledge to identify the correct UART pins and baud rate. No network connectivity, no pre-existing credentials, and no elevated software privileges are required. The physical access requirement (CVSS AV:P) is the single dominant limiting factor and makes mass or remote exploitation impossible.

Real-world risk is constrained but non-trivial for physically accessible deployments. The CVSS score of 4.6 and vector AV:P accurately reflect the physical access prerequisite, which substantially limits the realistic attacker population. EPSS at 0.18% (8th percentile) is consistent with a vulnerability that cannot be exploited remotely or at scale. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. SSVC flags Exploitation: poc and Automatable: no - a proof-of-concept exists but requires per-device physical contact, preventing automation. Notably, the NVD-provided CVSS vector marks I:N (no integrity impact), yet the CVE description explicitly states the wr command enables writing arbitrary memory - this is a probable scoring discrepancy, and defenders should treat this as having I:H potential for planning purposes. Primary risk scenarios involve supply chain inspection, hardware theft, insider access in shared environments (hotels, SMB offices, retail back offices), or targeted physical attacks. For home routers in shared or semi-public spaces, the physical attack surface is broader than for enterprise infrastructure locked behind access controls.

An attacker with brief physical access to a Tenda N300 F3 - such as in a hotel network closet, retail back office, or unattended SMB environment - opens the router casing, attaches a USB-to-TTL serial adapter to the exposed UART header, and accesses the debug console without any authentication prompt. The attacker issues the rr command to read memory regions containing the cleartext WPA2 PSK, immediately obtaining credentials usable for wireless network access. A public proof-of-concept documenting this technique is referenced in the SSVC data.