CVE-2026-5527
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Tenda 4G03 Pro version 1.0/1.0re/01.bin/04.03.01.53, a hard-coded ECDSA P-256 cryptographic key is used in /etc/www/pem/server.key. The attack can be performed remotely.
Risk Assessment
Use of a hard-coded cryptographic key allows an attacker to impersonate the device or decrypt communications, potentially leading to device takeover.
Recommendation
Immediately change the default key and update the device firmware.
Original NVD description (English source)
A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the file /etc/www/pem/server.key of the component ECDSA P-256 Private Key Handler. This manipulation causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely.