EUVD-2026-19046
GHSA-7v8w-cr25-ggqq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Impact | CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflects low attack complexity and no authentication requirement, but limited impact scope (confidentiality only, no integrity or availability). EPSS data indicates this has moved beyond theoretical risk: publicly available exploit code (E:P) exists on GitHub with weak remediation (RL:W) and reproducible conditions (RC:R). While CVSS assigns Medium severity, the absolute compromise of cryptographic trust-combined with public exploit availability-elevates real-world priority for any Tenda AC10 deployment exposed to untrusted networks. This is not a low-risk high-CVSS issue; the attack is trivial (unauthenticated HTTP fetch) and the impact (key theft) is complete. Organizations running AC10 firmware 16.03.10.10_multi_TDE01 should prioritize remediation. |
| Exploit ScenarioDerived | An attacker on the same network or with internet access to an unprotected Tenda AC10 router (e.g., via port forwarding or in a public/semi-public venue) sends an HTTP GET request to http://[router_ip]/webroot_ro/pem/privkeySrv.pem without authentication and downloads the 2048-bit RSA private key. Using this key, the attacker can decrypt historical encrypted traffic captured via passive network sniffing, forge TLS certificates impersonating the router for man-in-the-middle attacks, or decrypt future encrypted sessions between clients and the router. Publicly available exploit code (https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-05-exposed-rsa-private-key.md) automates key extraction, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Tenda AC10 router firmware 16.03.10.10_multi_TDE01 exposes a hard-coded RSA 2048-bit private key in the world-readable file /webroot_ro/pem/privkeySrv.pem, allowing unauthenticated remote attackers to retrieve sensitive cryptographic material and decrypt encrypted communications. With publicly available exploit code and an EPSS score indicating moderate but real-world feasibility, this vulnerability enables information disclosure attacks against affected router configurations.
RemediationAI
Upgrade Tenda AC10 firmware to a patched version released by Tenda after the discovery of CVE-2026-5549; consult https://www.tenda.com.cn/ for the latest firmware release notes and supported versions. Interim mitigations include restricting network access to the router's web interface via firewall rules, disabling remote management if not required, and resetting or rotating any certificates that relied on the exposed private key. Verify firmware integrity after upgrade and regenerate any certificates that were signed with the compromised key. Consult VulDB entry https://vuldb.com/vuln/355313 for additional technical details and confirmation of patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-321 (Use of Hard-coded Cryptographic Key), a critical weakness in cryptographic key management. The Tenda AC10 router stores its RSA 2048-bit server private key in an unprotected file accessible via HTTP GET requests without authentication. RSA private keys are foundational to TLS/SSL encryption, certificate signing, and secure communications; exposure of this key completely compromises the confidentiality and authenticity guarantees provided by the router's HTTPS implementation. An attacker with network access to the router (CPE: cpe:2.3:a:tenda:ac10:*:*:*:*:*:*:*:*) can extract the key and decrypt all past and future TLS sessions, forge certificates, or impersonate the router to legitimate clients.
Know when Ac10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Tenda AC10 Command Injection and Hardcoded Key
View all 2Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumve
Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated a
Stack-based buffer overflow in Tenda AC10 router firmware version 16.03.10.10_multi_TDE01 allows authenticated remote at
Stack-based buffer overflow in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers
Exploit-DB