CVE-2026-5526

HighCVSS 7.3

Published: 04/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Tenda 4G03 Pro up to version 1.0/1.1/04.03.01.53/192.168.0.1 contains an improper access control vulnerability in the /bin/httpd file. The attack can be performed remotely, and the exploit has been publicly released.

Risk Assessment

A remote attacker could gain unauthorized access to the device, potentially leading to router takeover.

Recommendation

Update the Tenda 4G03 Pro firmware to the latest version if available.

Other vulnerabilities in Tenda 4G03 Pro

CVE-2026-5527Medium
In Tenda 4G03 Pro version 1.0/1.0re/01.bin/04.03.01.53, a hard-coded ECDSA P-256 cryptographic key is used in /etc/www/pem/server.key. The attack can be performed remotely.

Original NVD description (English source)

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.