EUVD-2026-19001Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Improper access controls in Tenda 4G03 Pro firmware (versions up to 04.03.01.53) enable unauthenticated remote attackers to bypass authentication mechanisms via the /bin/httpd binary, potentially achieving unauthorized administrative access to the router. This vulnerability has publicly available exploit code and affects consumer-grade 4G routers commonly used for home and small office networks. EPSS data not available, but the combination of network-accessible attack vector, low complexity, and public exploit elevates real-world risk.
Technical ContextAI
The vulnerability resides in the /bin/httpd binary of Tenda 4G03 Pro routers, which implements the web-based administrative interface. The flaw is classified as CWE-284 (Improper Access Control), indicating insufficient enforcement of access restrictions on administrative functions. The httpd daemon likely fails to properly validate authentication credentials or session tokens before granting access to privileged operations. As a 4G LTE router product (CPE: cpe:2.3:a:tenda:4g03_pro), this device provides internet connectivity and network routing functions, making authentication bypass particularly severe as it exposes all router configuration and network traffic controls to unauthorized parties. The CVSS vector AV:N indicates the attack is executable over the network without requiring local access, and PR:N confirms no authentication is required to exploit the flaw.
RemediationAI
No vendor-released patch identified at time of analysis; CVSS remediation level indicates only workarounds available (RL:W). Users should immediately check the official Tenda support website (https://www.tenda.com.cn/) for updated firmware releases beyond version 04.03.01.53 that may address this access control flaw. As interim mitigation, disable remote administration features and restrict web interface access to trusted LAN segments only, preventing internet-facing exposure of the httpd service. Implement network-level access controls (firewall rules) to block external access to the router's management interface on standard ports (TCP 80/443). Consider replacing affected devices with alternative router models if Tenda does not release timely security updates. Monitor VulDB entries (https://vuldb.com/vuln/355279) for patch availability updates and additional technical indicators of compromise.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today