# CVE-2026-5549: Tenda AC10 hard-coded RSA private key in webroot

Source: https://junglewise.ai/threats/cve-2026-5549-tenda-ac10-hard-coded-rsa-private-key-in-webroot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5549 · Severity: medium · CVSS 5.3 · Published 2026-04-05

A security vulnerability exists in the Tenda AC10 router, a device used to provide wireless internet in homes and small offices. The router's software contains a publicly accessible, unencrypted security key used for secure web communications. An attacker can use this key to monitor private web traffic, steal administrator passwords, and take full control of the device.

Technologies: [Tenda AC10](https://junglewise.ai/threats/technologies/ac10), [Tenda AC10 firmware](https://junglewise.ai/threats/technologies/ac10-firmware). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-5549 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5549 being exploited in the wild.

**How severe is CVE-2026-5549?** Medium severity, with a CVSS score of 5.3, published 5 April 2026.

**Which products and versions are affected?** Tenda AC10 firmware 16.03.10.10_multi_TDE01.

**Is there a fix for CVE-2026-5549?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5549 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-5549?** Check whether you run Tenda AC10 or Tenda AC10 firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Tenda AC10 router (firmware version 16.03.10.10_multi_TDE01) stores an unencrypted 2048-bit RSA private key in a web-accessible directory at '/webroot_ro/pem/privkeySrv.pem'. This key is used by the httpd TLS server for HTTPS communications. Because the file is accessible without authentication via the web interface, a remote network-adjacent attacker can retrieve the key. This allows for the decryption of TLS traffic, Man-in-the-Middle (MitM) attacks, and the theft of administrator credentials transmitted over what is intended to be a secure connection. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key).

## Affected products

- Tenda AC10 Firmware 16.03.10.10_multi_TDE01

## Timeline

- 2026-03-18: disclosed: Private disclosure to Tenda product security team.
- 2026-04-05: advisory: Initial disclosure via VulDB and NVD.

## References

- [https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-05-exposed-rsa-private-key.md](https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-05-exposed-rsa-private-key.md)
- [https://vuldb.com/submit/782298](https://vuldb.com/submit/782298)
- [https://vuldb.com/vuln/355313](https://vuldb.com/vuln/355313)
- [https://vuldb.com/vuln/355313/cti](https://vuldb.com/vuln/355313/cti)
- [https://www.tenda.com.cn/](https://www.tenda.com.cn/)

## Related threats

- [Tenda AC10 stack buffer overflow in fromAdvSetLanip](https://junglewise.ai/threats/cve-2026-16248-tenda-ac10-stack-buffer-overflow-in-fromadvsetlanip)
- [Tenda AC10 v3 buffer overflow in UploadCfg](https://junglewise.ai/threats/cve-2026-51380-tenda-ac10-v3-buffer-overflow-in-uploadcfg)
- [Tenda Firmware authentication backdoor in httpd login function](https://junglewise.ai/threats/cve-2026-11405-tenda-firmware-authentication-backdoor-in-httpd-login-function)
- [Tenda AC10 stack buffer overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5550-tenda-ac10-stack-buffer-overflow-in-fromsystoolchangepwd)
- [Tenda AC10 stack overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5548-tenda-ac10-stack-overflow-in-fromsystoolchangepwd)