CVE-2026-86150

Received Received - Intake

Hard-Coded Credentials in Tenda CP3 Router Firmware

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulDB

Description

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-05

Last Modified

2026-09-05

Generated

2026-09-06

AI Q&A

2026-09-06

EPSS Evaluated

N/A

NVD

CVE-2026-86150

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	cp3	27.5.57.101

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

Executive Summary

This vulnerability in Tenda CP3 27.5.57.101 involves hard-coded credentials due to manipulation of the wpa_passphrase argument in the file custom-x/softap/hostapd. The issue allows remote attackers to exploit an unknown function, potentially gaining unauthorized access.

Detection Guidance

This vulnerability involves hard-coded credentials in Tenda CP3 devices due to manipulation of the wpa_passphrase argument. Detection requires checking for default or exposed credentials in hostapd configurations or network settings. No specific commands are provided in the context, but inspecting device configurations and network traffic for default credentials may help.

Impact Analysis

An attacker could exploit this to gain access to the device's network or configuration, leading to data breaches, unauthorized network use, or further attacks on connected systems. The public disclosure increases the risk of exploitation.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data. Organizations using affected devices could face compliance failures, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the Tenda CP3 firmware to the latest version to address the hard-coded credentials issue. Disable remote access to the device if not required and change default credentials to strong, unique passwords.

Hi! I’m here to help you understand CVE-2026-86150. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70