CVE-2026-5526

Tenda 4G03 Pro httpd access control

State: Published
Severity: 6.9 Medium
Published: Apr 4, 2026
Updated: Apr 6, 2026
Reserved: Apr 4, 2026

Description

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR	VulDB

Weaknesses

CWE-284 Improper Access Controls
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
4G03 ProTenda	1.0Affected 1.1Affected 04.03.01.0Affected 04.03.01.1Affected 04.03.01.2Affected 04.03.01.3Affected 04.03.01.4Affected 04.03.01.5Affected 04.03.01.6Affected 04.03.01.7Affected 04.03.01.8Affected 04.03.01.9Affected 04.03.01.10Affected 04.03.01.11Affected 04.03.01.12Affected 04.03.01.13Affected 04.03.01.14Affected 04.03.01.15Affected 04.03.01.16Affected 04.03.01.17Affected 04.03.01.18Affected 04.03.01.19Affected 04.03.01.20Affected 04.03.01.21Affected 04.03.01.22Affected and 33 more versions

Product

Versions

4G03 ProTenda

1.0Affected
1.1Affected
04.03.01.0Affected
04.03.01.1Affected
04.03.01.2Affected
04.03.01.3Affected
04.03.01.4Affected
04.03.01.5Affected
04.03.01.6Affected
04.03.01.7Affected
04.03.01.8Affected
04.03.01.9Affected
04.03.01.10Affected
04.03.01.11Affected
04.03.01.12Affected
04.03.01.13Affected
04.03.01.14Affected
04.03.01.15Affected
04.03.01.16Affected
04.03.01.17Affected
04.03.01.18Affected
04.03.01.19Affected
04.03.01.20Affected
04.03.01.21Affected
04.03.01.22Affected
and 33 more versions

References

VDB-355279 | Tenda 4G03 Pro httpd access controlvdb-entry
VDB-355279 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #782052 | Tenda Tenda 4G03 Pro V1.0 V04.03.01.53 Authentication Bypass Issuesthird-party-advisory
https://www.tenda.com.cn/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.