This vulnerability affects certain Tenda devices (CH, CP, TX3) in versions V21.x to V27.x and involves a hard-coded password within the SSH component. An attacker with high skill could remotely exploit this flaw to gain unauthorized access. The CVSS 4.0 score is 9.2 (critical), indicating a severe security risk. Exploit code has been published, but no known active exploitation in the wild has been reported. The vendor has not provided a remediation level or patch information at this time.

Successful exploitation could allow a remote attacker to bypass authentication via the hard-coded SSH password, potentially leading to unauthorized access to the affected device. Given the critical CVSS score and remote attack vector, this could compromise device confidentiality and integrity. However, exploitation requires high complexity and no privilege or user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SSH access to trusted networks and monitor for unusual SSH login attempts. Avoid exposing affected devices directly to untrusted networks.