Insecure Hardcoded Credentials in Tenda HG21 Admin Account
CVE-2026-38577

9.8CRITICAL

Key Information:

Vendor

Tenda
Status
Tenda HG21
Vendor
CVE Published:
31 August 2026

What is CVE-2026-38577?

The Tenda HG21 device, version V4.0.0-260302, contains insecure hardcoded credentials in its Admin account, allowing unauthorized attackers to gain root access. This vulnerability poses significant risks, as it enables potential exploitation of the device, leading to unauthorized control and data breaches within the network.

References

https://gist.github.com/Anmolsingh142/a4be5a8c483f57e0887...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.