Tenda HG21 CVE-2026-38577

Exploitation requires network reachability to the HG21's Admin/management service and knowledge of the static hardcoded credential (which is documented publicly), and applies to firmware V4.0.0-260302. No legitimate account, user interaction, or non-default configuration is needed per the CVSS vector (PR:N/UI:N). The principal limiting factor is exposure of the management interface: if the admin service is confined to the LAN or a trusted segment and blocked from the WAN, a remote attacker cannot reach it, reducing realistic risk to on-LAN adversaries despite the AV:N rating.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) describes a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact - consistent with static credentials granting root over the network. Countering that, EPSS is only 0.15% (4th percentile) and the CVE is not in CISA KEV, so there is no signal of active or automated mass exploitation at this time. The tension here is typical for consumer-gateway credential bugs: technically trivial and high-impact, but real-world exposure depends on how many HG21 units expose their management interface to untrusted networks (LAN vs. WAN). Priority should be high for any deployment where the device management plane is reachable beyond a trusted segment; the low EPSS reflects limited attacker attention/footprint rather than any mitigating difficulty.

An attacker who can reach the HG21 management interface (e.g., an exposed WAN-side admin service, or any host on the same LAN segment) supplies the publicly known hardcoded Admin credentials and logs in as root, gaining full control of the gateway. From there they can alter DNS/routing, capture or redirect traffic, pivot into the internal network, or persist on the device. A public gist documents the credential and technique, lowering the effort required.