Ch
Monthly
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.
When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.
When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.