Executive Summary

This vulnerability (CVE-2026-5549) affects the Tenda AC10 router firmware version 16.03.10.10_multi_TDE01. It involves an unencrypted RSA 2048-bit private key stored in a web-accessible directory at /webroot_ro/pem/privkeySrv.pem. Because this private key is stored in plaintext and accessible via the device's web interface without authentication, any network-adjacent attacker can retrieve it simply by requesting the file.

The private key is used by the device's HTTP daemon TLS server, so exposing it allows attackers to compromise the device's HTTPS security. This enables them to decrypt HTTPS traffic, perform man-in-the-middle attacks by impersonating the router with a valid-looking certificate, hijack active administrative sessions, and capture admin credentials submitted over HTTPS.

The vulnerability is worsened by the use of a self-signed TLS certificate with the deprecated SHA-1 signature algorithm, which weakens cryptographic security further.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected Tenda AC10 device, this vulnerability can have serious security impacts. Attackers can remotely access the device's private TLS key, allowing them to decrypt all HTTPS traffic to and from the device, including sensitive administrative sessions.

• Decryption of HTTPS traffic, exposing sensitive data.
• Man-in-the-middle attacks by impersonating the router with a valid certificate.
• Hijacking of active admin sessions transmitted over HTTPS.
• Capture of administrator credentials in plaintext.

Overall, this vulnerability compromises the confidentiality and integrity of communications with the device, potentially allowing attackers to take control or intercept sensitive information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the RSA 2048-bit private key file is accessible via the device's web interface without authentication.

A simple way to detect this is to attempt to retrieve the file located at /webroot_ro/pem/privkeySrv.pem from the device using HTTP requests.

• Use curl or wget to request the private key file: curl http://<device-ip>/webroot_ro/pem/privkeySrv.pem
• If the file is returned in plaintext (about 1675 bytes), the device is vulnerable.
• You can also scan your network for devices responding to this request to identify all vulnerable devices.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing unauthorized access to the private key file and improving the cryptographic setup.

• Move the private key file outside the web root directory to block HTTP access.
• Apply strict file system permissions so that only the httpd process can read the private key.
• Generate a unique private key per device at first boot instead of using a shared hard-coded key.
• Replace the self-signed SHA-1 certificate with a SHA-256 signed certificate to strengthen cryptographic security.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes an unencrypted RSA 2048-bit private key accessible via the device's web interface, allowing attackers to decrypt HTTPS traffic, hijack administrative sessions, and capture credentials in plaintext.

Such exposure of sensitive cryptographic material and credentials can lead to unauthorized access and data breaches, which may violate data protection requirements under standards like GDPR and HIPAA.

Specifically, the lack of encryption and insufficient protection of credentials (CWE-311, CWE-522) and use of hard-coded cryptographic keys (CWE-321) undermine the confidentiality and integrity of sensitive data, potentially resulting in non-compliance with regulations mandating strong data security controls.

Remediation steps such as removing the private key from web-accessible locations, enforcing strict permissions, and using unique per-device keys are necessary to align with compliance requirements.

Useful 0 Not Useful 0