Which versions of Tenda are affected by EUVD-2026-19001?

Tenda 4G03 Pro routers (firmware ≤04.03.01.53) contain an unauthenticated remote access control bypass that allows attackers to gain administrative access without credentials.

How to fix or mitigate EUVD-2026-19001?

Within 24 hours: Identify all Tenda 4G03 Pro devices on your network using asset inventory tools and network scanning. Within 7 days: Contact Tenda support to confirm firmware update availability and escalation timeline; implement network segmentation to isolate affected routers from sensitive systems. Within 30 days: Deploy firmware update to version 04.03.01.54 or later (when released); if no patch emerges, replace units with alternative vendor equipment or implement authenticated proxy/VPN access controls.

Tenda EUVD-2026-19001

Q: What is the CVSS score of EUVD-2026-19001?

EUVD-2026-19001 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5526 MEDIUM

Improper Access Control (CWE-284)

2026-04-04 VulDB

Tenda Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 04, 2026 - 22:30 euvd

EUVD-2026-19001

Analysis Generated

Apr 04, 2026 - 22:30 vuln.today

CVE Published

Apr 04, 2026 - 22:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Improper access controls in Tenda 4G03 Pro firmware (versions up to 04.03.01.53) enable unauthenticated remote attackers to bypass authentication mechanisms via the /bin/httpd binary, potentially achieving unauthorized administrative access to the router. This vulnerability has publicly available exploit code and affects consumer-grade 4G routers commonly used for home and small office networks. EPSS data not available, but the combination of network-accessible attack vector, low complexity, and public exploit elevates real-world risk.

Technical ContextAI

The vulnerability resides in the /bin/httpd binary of Tenda 4G03 Pro routers, which implements the web-based administrative interface. The flaw is classified as CWE-284 (Improper Access Control), indicating insufficient enforcement of access restrictions on administrative functions. The httpd daemon likely fails to properly validate authentication credentials or session tokens before granting access to privileged operations. As a 4G LTE router product (CPE: cpe:2.3:a:tenda:4g03_pro), this device provides internet connectivity and network routing functions, making authentication bypass particularly severe as it exposes all router configuration and network traffic controls to unauthorized parties. The CVSS vector AV:N indicates the attack is executable over the network without requiring local access, and PR:N confirms no authentication is required to exploit the flaw.

RemediationAI

No vendor-released patch identified at time of analysis; CVSS remediation level indicates only workarounds available (RL:W). Users should immediately check the official Tenda support website (https://www.tenda.com.cn/) for updated firmware releases beyond version 04.03.01.53 that may address this access control flaw. As interim mitigation, disable remote administration features and restrict web interface access to trusted LAN segments only, preventing internet-facing exposure of the httpd service. Implement network-level access controls (firewall rules) to block external access to the router's management interface on standard ports (TCP 80/443). Consider replacing affected devices with alternative router models if Tenda does not release timely security updates. Monitor VulDB entries (https://vuldb.com/vuln/355279) for patch availability updates and additional technical indicators of compromise.