CVE-2026-1610
📋 TL;DR
The Tenda AX12 Pro V2 router contains hard-coded credentials in its Telnet service, allowing remote attackers to gain unauthorized access. This affects users of Tenda AX12 Pro V2 routers with firmware version 16.03.49.24_cn. Attackers can exploit this to compromise the router's administration interface.
💻 Affected Systems
- Tenda AX12 Pro V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept network traffic, deploy malware to connected devices, or use the router as a pivot point into internal networks.
Likely Case
Unauthorized access to router configuration, enabling network reconnaissance, DNS hijacking, or credential theft from network traffic.
If Mitigated
Limited impact if Telnet service is disabled and strong perimeter controls prevent external access to router management interfaces.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making weaponization straightforward despite the CVE's complexity rating.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download and install the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Disable Telnet Service
allTurn off the Telnet service to prevent exploitation via this vector.
Access router admin interface -> Advanced Settings -> System Services -> Disable Telnet
Restrict Management Interface Access
allLimit access to router management interfaces to trusted IP addresses only.
Access router admin interface -> Security -> Firewall -> Add rules to restrict Telnet/SSH/HTTP access
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict network segmentation
- Implement network monitoring for Telnet authentication attempts and unusual router configuration changes
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 16.03.49.24_cn, the device is vulnerable.Check Version:
Login to router web interface and check System Status or About page for firmware version.Verify Fix Applied:
Verify Telnet service is disabled or test authentication with known hard-coded credentials (if disclosed).📡 Detection & Monitoring
Log Indicators:
- Failed/successful Telnet authentication attempts from unexpected sources
- Router configuration changes without authorized user activity
Network Indicators:
- Telnet connections to router on port 23 from external IPs
- Unusual outbound traffic from router to unknown destinations
SIEM Query:
source="router_logs" AND (event="telnet_login" OR event="configuration_change")