Executive brief
Tenda smart cameras (CH, CP, and TX3 series) contain a hard-coded SSH root password that is identical across all affected devices. An attacker who gains access to the web management interface can enable SSH debugging and use this leaked credential to obtain root-level system access, allowing them to read sensitive files, steal cloud credentials, modify device behavior, or use the camera as a pivot point for network attacks.
Technical details
This is a hard-coded credentials vulnerability in Tenda smart camera firmware (versions V21.x through V27.x) based on the ZhiLing/Kylin OEM solution. The firmware contains an identical SSH root password hash across all devices; this hash was extracted from firmware upgrade packages and cracked to recover the plaintext password. The Kylin main program includes logic to enable SSH debugging via configuration fields, which triggers the Dropbear SSH service. An attacker with web administrator privileges can enable SSH debugging and authenticate as root using the hard-coded credential, achieving privilege escalation from web administrator to system administrator. Attack vector is network-based and requires prior web admin access; the exploitation is known to be difficult but a public proof-of-concept exists. Once root access is obtained, attackers can exfiltrate cloud credentials, modify device behavior, or use the camera as an internal network pivot or botnet node.
Affected products
- Tenda CH V21.x, V22.x, V25.x, V26.x, V27.x
- Tenda CP V21.x, V22.x, V25.x, V26.x, V27.x
- Tenda TX3 V21.x, V22.x, V25.x, V26.x, V27.x
Timeline
- 2026-08-13: disclosed
- other: Public proof-of-concept available on GitHub