Tx3
Monthly
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.