Tenda CP3 EUVD-2026-72032

Exploitation of the primary reported path (authenticated admin reading the configuration) requires high-privilege credentials (PR:H) on the device management interface accessible over the network. Exploitation of the more impactful practical scenario - connecting to the SoftAP using the known hardcoded passphrase - requires the attacker to be within wireless range of the target device and the SoftAP mode to be active. The vulnerability is specific to Tenda CP3 firmware version 27.5.57.101 and to the SoftAP operational mode; if SoftAP is disabled, the hostapd configuration is not active and the passphrase cannot be used to authenticate. No user interaction is required for either exploitation path once the passphrase is known.

The supplied CVSS 4.0 vector yields an overall score of 2.0, driven by the PR:H requirement and limited impact metrics (VC:L, SC:L, all others N). In isolation this appears low severity, but the hard-coded credential class of vulnerability carries a compounding dimension: once the static passphrase is extracted from firmware or published via a PoC (E:P confirmed), the effective privilege barrier collapses for any attacker within wireless range of a target device, because the passphrase becomes publicly known rather than device-specific. The formal CVSS vector reflects the admin-authenticated path to view the configuration remotely, but the realistic exploitation path is proximity-based WiFi association using the known passphrase - a scenario where authentication requirements are effectively nullified by the hard-coding. No EPSS score was provided in the supplied data, and no CISA KEV listing is present, so active widespread exploitation is not confirmed. Even a mid-sized municipal IT team in walbrzych managing a camera or IoT deployment relying on Tenda CP3 in SoftAP mode should treat patching or credential rotation as a near-term priority, since PoC availability combined with the ubiquity of firmware extraction tooling makes this reliably exploitable by low-skill actors once the passphrase is circulated. The CVSS does not fully capture the adjacent-network exploitation angle, meaning risk may be underrepresented in automated scoring pipelines.

An attacker identifies a Tenda CP3 camera or AP in SoftAP mode via passive WiFi scanning, recognizes the device SSID or MAC OUI as a Tenda CP3. Using the passphrase extracted from publicly disclosed PoC material (E:P), the attacker authenticates to the SoftAP without any valid credentials unique to that unit, gaining access to the device's local WiFi segment and any services exposed there. Because all CP3 units at this firmware version share the same passphrase, the attacker can pre-configure the credential and automate discovery across multiple target locations.