Vulnerability · Published Apr 4, 2026 · Assigned by VulDB
CVE-2026-5527Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key
Medium 5.3
In plain English
A medium-severity security flaw in 4G03 Pro from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the file /etc/www/pem/server.key of the component ECDSA P-256 Private Key Handler. This manipulation causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely.
Affected products (as reported)
Weakness: CWE-321, CWE-320 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R
References
- VDB-355280 | Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key vdb-entry
- VDB-355280 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #782053 | Tenda 4G03 Pro V1.0 V04.03.01.53 Cryptographic Issues third-party-advisory
- https://www.tenda.com.cn/ product