EUVD-2026-78815
GHSA-72mq-q5h9-26hv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network access to NVR
-
ExploitExtract hardcoded cryptographic key from firmware
-
ExecutionDecrypt or forge protected communications
-
ImpactAccess confidential video/config data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Exploitation Conditions | Exploitation requires (1) network adjacency to the affected device - specifically Tenda NVR_4H CH3 v2.1 firmware V27.5.58.6 - consistent with AV:A, and (2) recovery of the embedded hardcoded cryptographic key, typically via firmware extraction/analysis (reflected in AC:H). No authentication or user interaction is needed once the key is known (PR:N/UI:N). Limiting factors: the flaw is not remotely reachable across the internet by default, the attacker must invest in firmware reverse-engineering to obtain the key, and impact is bounded to devices running this specific model/firmware - narrowing realistic exploitation to adjacent, targeted scenarios rather than mass exploitation. |
| Impact | This is a genuinely modest real-world risk despite the 7.5 (HIGH) vendor score. The CVSS vector itself tempers the number: AV:A confines exploitation to the adjacent/local network (not internet-wide), and AC:H signals meaningful attacker effort - consistent with a hardcoded cryptographic key that must first be extracted from firmware before it yields value. PR:N/UI:N are the only aggravating factors. Corroborating signals point away from urgency: EPSS is 0.26% (18th percentile), it is NOT on CISA KEV, and there is no evidence of active exploitation. A public POC does exist (GitHub snyi001/CVE-2026-79551-Tenda), which raises the practical likelihood that the key and its use are documented, but POC availability is a distinct signal from active exploitation and should not be conflated. Note a tension worth flagging: the vendor rates C:H/I:H/A:H (full triad), yet a hardcoded cryptographic-key weakness (CWE-321) most naturally undermines confidentiality and possibly integrity/authentication - the A:H (availability) impact is not obviously justified by the description and should be verified with the vendor. Net: a real but low-priority, network-adjacent hardware weakness, not a drop-everything issue. |
| Exploit ScenarioDerived | An attacker on the same LAN/adjacent network as a Tenda NVR_4H CH3 extracts the hardcoded cryptographic key (published firmware or the public POC makes this feasible), then uses it to decrypt protected communications/stored data or to forge/authenticate as a trusted party. A public POC exists, lowering the effort to reproduce, though the AC:H rating reflects the firmware-analysis step still required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Hardcoded cryptographic keys embedded in the Tenda NVR_4H CH3 v2.1 network video recorder (firmware V27.5.58.6) allow an adjacent, unauthenticated attacker who recovers that key from device firmware to defeat the protection it is meant to provide - decrypting or forging protected data, and potentially tampering with device configuration or video-related communications (CWE-321). Exploitation is constrained: the attacker must first obtain the key, typically by extracting and reverse-engineering the firmware (AC:H), and must already be on the same network segment as the NVR (AV:A), which is why our independent assessment lands at a modest risk despite the 7.5 HIGH vendor score and the low EPSS of 0.26% (18th percentile). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a GitHub repository referencing the CVE appears among the references and its contents were not independently verified.
RemediationAI
No vendor-released patch or fixed firmware version is identified at time of analysis, so remediation is containment rather than correction: check the vendor material page (https://www.tendacn.com/material/show/805569838370885) and Tenda support channels for a newer NVR_4H firmware and apply it as soon as one is published. Because a hardcoded key cannot be rotated through configuration, the practical mitigations are architectural - place the NVR on a dedicated, isolated VLAN or surveillance network segment with no inbound access from user or guest networks, and block the device's management interfaces from WAN exposure and from untrusted hosts; the trade-off is that this breaks flat-network remote viewing and may require adding a jump host or VPN concentrator. Disable cloud/P2P remote-access and UPnP features if remote viewing is not required, which reduces the reachable attack surface at the cost of losing out-of-network access. Restrict who can physically touch the unit (locked rack or enclosure) since firmware extraction via flash, UART, or JTAG is the most direct route to the key. Treat all secrets the device protects - admin credentials, configuration backups, and any shared key or certificate used for client or NVR-to-camera communications - as compromised: change the admin password, avoid exporting or restoring configuration backups over untrusted channels, and prefer VPN/tunneled access over the device's native remote protocols. Finally, monitor the NVR's segment for anomalous access to management ports or unexpected outbound connections and alert on connections from hosts that do not normally view the video streams.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-321 (Use of Hard-coded Cryptographic Key): the firmware of the Tenda NVR_4H CH3 v2.1 surveillance recorder ships with a static cryptographic key baked into the image, rather than generating or provisioning unique per-device keys. Because the key is identical across units and cannot be rotated through normal configuration, anyone who extracts the firmware - via a downloaded vendor image, flash dump, UART/JTAG console, or an exposed update channel - obtains material that should be secret. That key is likely used to protect configuration backups, stored credentials, firmware integrity checks, or device-to-client communications, so possession of it can enable decryption of sensitive data and, depending on the scheme, forgery or replay of trusted messages. The supplied CPE strings are unpopulated placeholders (cpe:2.3:a:n/a:n/a:*) and the EUVD affected-version field is also 'n/a', so product identification rests on the CVE description and vendor references rather than authoritative CPE mapping. Both the NVD vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) and our assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 6.8) agree the attack requires network adjacency and unauthenticated access once the key is known, with no user interaction; they differ only on whether availability impact should be claimed, and our assessment treats the impact as bounded to this specific model and firmware. This is a genuinely modest real-world risk despite the 7.5 (HIGH) vendor score, because it is not reachable across the internet by default, requires deliberate firmware reverse-engineering, and cost/benefit favors targeted adjacent attackers over mass exploitation.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Key must be extracted from firmware (AC:H) over the adjacent network (AV:A) with no auth (PR:N); a static crypto key breaks confidentiality and enables forgery (C:H/I:H) but does not inherently cause availability loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
Executive ViewAI
Tenda NVR_4H CH3 v2.1 network video recorders running firmware V27.5.58.6 ship with hardcoded cryptographic keys, meaning any attacker who can reach the device from the same network segment and extract the key from firmware can defeat the encryption protecting device configuration and video-related communications. Because these units typically sit on trusted internal networks recording physical security footage, a compromise could expose or allow tampering with surveillance data and device settings - a confidentiality, integrity, and physical-security risk rather than a broad enterprise outage. Exploitation requires firmware extraction plus adjacent network access and no public exploit or active exploitation has been identified, so leadership should treat this as a contained but persistent exposure requiring inventory and network-hardening action rather than emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment the NVR onto a dedicated VLAN with no inbound access from untrusted or general-user networks; block all adjacent-segment access to the device management interface; enforce unique strong administrative credentials and restrict physical and console access; disable unnecessary remote access and services; log and monitor configuration changes and access attempts; consider replacing or wrapping affected devices behind an encrypted, access-controlled tunnel where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB