Executive brief
Tenda's NVR_4H network video recorder firmware contains a hardcoded ECDSA private key baked into every device at manufacturing time. An attacker with network access can extract this key from the publicly available firmware, impersonate the NVR over HTTPS, and intercept or modify all management traffic including admin credentials and camera feeds. This enables complete compromise of the device and its connected cameras without any user interaction.
Technical details
The vulnerability is a hardcoded cryptographic key (CWE-321) in the NVR_4H firmware version V27.5.58.6, where an ECDSA P-256 private key and self-signed certificate are stored in the read-only /opt/app/ filesystem partition and are identical across all devices. The private key can be extracted from the publicly downloadable firmware image via binwalk and unsquashfs. An attacker with network access (LAN, Wi-Fi, or internet-facing device) can perform a man-in-the-middle attack using ARP spoofing or DNS poisoning, present the extracted certificate, and transparently intercept HTTPS sessions without browser warnings. The attack requires no privileges on the target device and yields access to admin credentials, session tokens, RTSP camera credentials, and full device configuration. The recommended fix is to generate unique per-device key pairs on first boot and store them on a writable partition.
Affected products
- Tenda Technology Co., Ltd. NVR_4H V27.5.58.6 (hardware version CH3 v2.1)
Timeline
- 2026-09-15: disclosed