| Título | Tenda CP3 V3.2 V27.5.57.101 Use of Hard-coded Password |
|---|
| Descrição | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The firmware ships a SoftAP (setup/access-point) hostapd configuration with hard-coded wireless credentials.
In the extracted filesystem path custom-x/softap/hostapd the following values are present:
ssid=Tenda HGH
wpa=2
wpa_passphrase=Tenda123456
An attacker within wireless range of a device operating in SoftAP/provisioning mode can authenticate to the SoftAP using these well-known credentials. This may allow local network access to the camera during setup or SoftAP-enabled states and can facilitate further attacks against management or other network services.
Identification method: static analysis of the official firmware package (squashfs/custom partition). The hostapd configuration is present in the shipped firmware image.
Affected component: custom-x/softap/hostapd in firmware V27.5.57.101.
This is not a duplicate of CVE-2023-30351/CVE-2023-30352 (legacy CP3 hard-coded root/RTSP credentials on a different platform and firmware lineage) or CP3 Pro hard-coded credential issues on other product lines. This report specifically documents SoftAP WPA passphrase hard-coding in CP3 V3.2 V27.5.57.101 SoftAP hostapd configuration. |
|---|
| Utilizador | FengZi (UID 98139) |
|---|
| Submissão | 19/07/2026 09h14 (há 2 meses) |
|---|
| Moderação | 05/09/2026 09h40 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 399273 [Tenda CP3 27.5.57.101 custom-x/softap/hostapd wpa_passphrase Autenticação fraca] |
|---|
| Pontos | 17 |
|---|