CVE-2026-5549
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Tenda AC10 version 16.03.10.10_multi_TDE01, in the file /webroot_ro/pem/privkeySrv.pem of the RSA 2048-bit Private Key Handler component. Manipulation leads to use of a hard-coded cryptographic key. Remote attack possible, exploit publicly available.
Risk Assessment
An attacker can read or impersonate encrypted communication, potentially compromising data confidentiality and integrity.
Recommendation
Contact the vendor for a patch or replace the device with a newer model.
Other vulnerabilities in Tenda AC10
See all- CVE-2026-16248High
A vulnerability was found in Tenda AC10 version 16.03.10.09_multi_TDE01 in the fromAdvSetLanip function of the /goform/AdvSetLanip file. Manipulation of the GetValue/SetValue arguments leads to a stack-based buffer overflow, which can be exploited remotely.
- CVE-2026-19924Critical
A vulnerability has been detected in the Tenda AC10 router version 16.03.10.09_multi_TDE01. It affects the R7WebsSecurityHandler function in the httpd component, leading to improper authentication. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-51380Critical
A buffer overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint.
- CVE-2023-40904Critical
A stack overflow was discovered in Tenda AC10 v4 related to the parameters macFilterType and deviceList at the endpoint /goform/setMacFilterCfg.
- CVE-2023-37144Critical
A command injection vulnerability was discovered in Tenda AC10 v15.03.06.26 via the mac parameter in the function formWriteFacMac.
- CVE-2026-5550High
A stack-based buffer overflow vulnerability was identified in the fromSysToolChangePwd function of the /bin/httpd file in Tenda AC10 firmware version 16.03.10.10_multi_TDE01. The attack can be initiated remotely and may affect multiple endpoints.
- CVE-2026-5548High
A stack-based buffer overflow vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01 in the function fromSysToolChangePwd of the file /bin/httpd. Manipulating the argument sys.userpass results in buffer overflow, and the attack can be initiated remotely.
- CVE-2026-5547Medium
In the Tenda AC10 router version 16.03.10.10_multi_TDE01, the function formAddMacfilterRule in file /bin/httpd is vulnerable to OS command injection. The attack can be performed remotely, and multiple endpoints may be affected.
- CVE-2023-34571Medium
A stack overflow was discovered in the Tenda AC10 v4 device related to the shareSpeed parameter at the /goform/WifiGuestSet endpoint.
- CVE-2023-34569Medium
A stack overflow was discovered in the Tenda AC10 v4 device via parameter list at the /goform/SetNetControlList endpoint.
Original NVD description (English source)
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.