Executive brief
A security vulnerability exists in the Tenda AC10 router, a device used to provide wireless internet in homes and small offices. The router's software contains a publicly accessible, unencrypted security key used for secure web communications. An attacker can use this key to monitor private web traffic, steal administrator passwords, and take full control of the device.
Technical details
The Tenda AC10 router (firmware version 16.03.10.10_multi_TDE01) stores an unencrypted 2048-bit RSA private key in a web-accessible directory at '/webroot_ro/pem/privkeySrv.pem'. This key is used by the httpd TLS server for HTTPS communications. Because the file is accessible without authentication via the web interface, a remote network-adjacent attacker can retrieve the key. This allows for the decryption of TLS traffic, Man-in-the-Middle (MitM) attacks, and the theft of administrator credentials transmitted over what is intended to be a secure connection. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key).
Affected products
- Tenda AC10 Firmware 16.03.10.10_multi_TDE01
Timeline
- 2026-03-18: disclosed: Private disclosure to Tenda product security team.
- 2026-04-05: advisory: Initial disclosure via VulDB and NVD.