EUVD-2026-19003
GHSA-pgjq-fxv2-9p7v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Impact | This vulnerability presents moderate real-world risk despite the moderate CVSS score. The attack vector is network-based with low complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N), making it practically exploitable by remote actors. The CVSS exploitation maturity rating (E:P) indicates proof-of-concept code is likely available or will be developed. The primary impact is confidentiality loss (C:L) with no integrity or availability impact from the encryption perspective alone; however, once HTTPS communications are decrypted, secondary attacks become feasible. The Reliability rating (RL:W) and Confidence (RC:R) suggest incomplete vendor fix information. The critical signal is that the key is static across all deployed units-a single firmware extraction compromises all customers globally, making this a systemic rather than instance-specific threat. For organizations deploying these routers in security-sensitive environments, this is a priority remediation item despite the moderate score. |
| Exploit ScenarioDerived | An attacker downloads or obtains the Tenda 4G03 Pro firmware (either from public firmware repositories or through device compromise), extracts the /etc/www/pem/server.key file, and uses the hard-coded ECDSA private key to decrypt and forge HTTPS traffic between clients and the router. This enables the attacker to perform man-in-the-middle attacks, steal authentication credentials transmitted over HTTPS, or inject malicious content into device management communications without any prior device authentication. The attack is fully remote and requires no special interaction from device users or administrators. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 04, 2026
Tenda 4G03 Pro wireless router contains a hard-coded ECDSA P-256 private cryptographic key in the /etc/www/pem/server.key file, enabling remote attackers to decrypt HTTPS communications and potentially impersonate the device without authentication. The vulnerability affects firmware versions 1.0, 1.0re, 01.bin, and 04.03.01.53, and carries a CVSS score of 5.3 with proof-of-concept exploitation likely (E:P rating). No public exploit code has been independently confirmed at the time of this analysis.
RemediationAI
Organizations should contact Tenda directly at https://www.tenda.com.cn/ for a patched firmware release, as no specific fixed firmware version has been confirmed in available data. If a patch is released, perform a factory reset and upgrade the device to the latest firmware version available from Tenda's support portal. As an interim workaround, if the device is accessible via SSH or web administration interface, users may attempt to regenerate the server certificate and private key using device administration tools, though this depends on available device capabilities and may require firmware modification. Restrict network access to the device's web administration interface using firewall rules, and disable remote administration features if not operationally required. Monitor Tenda security advisories at https://www.tenda.com.cn/ for official patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from use of hard-coded cryptographic material (CWE-321) in the Tenda 4G03 Pro router's ECDSA P-256 implementation. The private key is embedded in the firmware file /etc/www/pem/server.key, which is used for TLS/SSL server certificate operations. When a cryptographic key is embedded statically across all device instances, any attacker possessing the firmware image or accessing the key through the web-accessible path can derive the private key material, compromising all confidentiality guarantees of encrypted communications between the device and clients. ECDSA P-256 (also known as secp256r1) is a standard elliptic-curve cryptography algorithm; the weakness is not in the algorithm itself but in the deployment practice of hard-coding the key.
Know when 4G03 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the file /etc/www/pem/server.key of the component ECDSA P-256 Private Key Handler. This manipulation causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB