PT-2026-30420 · Tenda · Tenda Ac10

Corenode · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda AC10 version 16.03.10.10 multi TDE01

Description A vulnerability exists in Tenda AC10 version 16.03.10.10 multi TDE01 related to the RSA 2048-bit Private Key Handler component and the file /webroot ro/pem/privkeySrv.pem. A manipulation of this file can lead to the use of a hard-coded cryptographic key. The attack can be launched remotely and has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-320

CWE-321

Related Identifiers

CVE-2026-5549

Affected Products

Tenda Ac10

References · 8

• 🔥 https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-05-exposed-rsa-private-key.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5549 · Security Note
• https://twitter.com/CVEnew/status/2040716623477199279 · Twitter Post
• https://vuldb.com/vuln/355313/cti · Note
• https://twitter.com/infoflowcloud/status/2040718887981899855 · Twitter Post
• https://tenda.com.cn · Note
• https://vuldb.com/submit/782298 · Note
• https://vuldb.com/vuln/355313 · Note