Vulnerability · Published Jan 29, 2026 · Assigned by VulDB

CVE-2026-1610Tenda AX12 Pro V2 Telnet Service hard-coded credentials

High 8.1

In plain English

A high-severity hard-coded credentials in AX12 Pro V2 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 45.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of the component Telnet Service. Performing a manipulation results in hard-coded credentials. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used.

Affected products (as reported)

Vendor	Product	Versions
Tenda	AX12 Pro V2	16.03.49.24_cn

Weakness: CWE-798, CWE-259 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-343378 | Tenda AX12 Pro V2 Telnet Service hard-coded credentials vdb-entry
VDB-343378 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #740766 | Tenda AX12 pro V2 V16.03.49.24_cn Hard-coded Credentials third-party-advisory
https://github.com/QIU-DIE/CVE/issues/49 broken-link, exploit, issue-tracking
https://www.tenda.com.cn/ product