Hard-Coded Credentials Vulnerability in Tenda CP3 Router
CVE-2026-86150

5.1MEDIUM

Key Information:

Vendor

Tenda
Status
Cp3
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86150?

A security vulnerability in the Tenda CP3 router version 27.5.57.101 was identified, where manipulation of arguments in the softap/hostapd file enables an attacker to exploit hard-coded credentials. This vulnerability allows for remote attacks, potentially compromising the security of the affected device. The exploit has been publicly disclosed, making it imperative for users to assess and reinforce their device security against unauthorized access.

Affected Version(s)

CP3 27.5.57.101

References

https://vuldb.com/vuln/399273
vdb-entrytechnical-description
https://vuldb.com/vuln/399273/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86150
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FengZi (VulDB User)
VulDB Vulnerability Moderation Team
.