| 제목 | Tenda CP3 V3.2 V27.5.57.101 Use of Hard-coded Password |
|---|
| 설명 | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The firmware ships a SoftAP (setup/access-point) hostapd configuration with hard-coded wireless credentials.
In the extracted filesystem path custom-x/softap/hostapd the following values are present:
ssid=Tenda HGH
wpa=2
wpa_passphrase=Tenda123456
An attacker within wireless range of a device operating in SoftAP/provisioning mode can authenticate to the SoftAP using these well-known credentials. This may allow local network access to the camera during setup or SoftAP-enabled states and can facilitate further attacks against management or other network services.
Identification method: static analysis of the official firmware package (squashfs/custom partition). The hostapd configuration is present in the shipped firmware image.
Affected component: custom-x/softap/hostapd in firmware V27.5.57.101.
This is not a duplicate of CVE-2023-30351/CVE-2023-30352 (legacy CP3 hard-coded root/RTSP credentials on a different platform and firmware lineage) or CP3 Pro hard-coded credential issues on other product lines. This report specifically documents SoftAP WPA passphrase hard-coding in CP3 V3.2 V27.5.57.101 SoftAP hostapd configuration. |
|---|
| 사용자 | FengZi (UID 98139) |
|---|
| 제출 | 2026. 07. 19. AM 09:14 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 05. AM 09:40 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399273 [Tenda CP3 27.5.57.101 custom-x/softap/hostapd wpa_passphrase 약한 인증] |
|---|
| 포인트들 | 17 |
|---|