← back
CVE-2026-1610

Tenda AX12 Pro V2 Telnet Service hard-coded credentials

CVSS 9.2 CRITICALEPSS 0.7%CWE-259CWE-798
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.2EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
29 Jan 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of the component Telnet Service. Performing a manipulation results in hard-coded credentials. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · AX12 Pro V2

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/QIU-DIE/CVE/issues/49https://vuldb.com/?ctiid.343378https://vuldb.com/?id.343378https://vuldb.com/?submit.740766https://www.tenda.com.cn/