This vulnerability affects certain Tenda devices (CH, CP, TX3) across multiple firmware versions (V21.x to V27.x). It stems from a hard-coded password within an SSH-related component, allowing remote attackers to potentially gain unauthorized access. The attack requires a high level of complexity and is difficult to execute. Exploit code has been made public, increasing the risk of potential exploitation. No vendor advisory or patch information is currently available, and the vulnerability is rated critical with a CVSS 4.0 score of 9.2.

Successful exploitation could allow remote attackers to bypass authentication via the hard-coded SSH password, potentially leading to unauthorized access to affected devices. Given the critical CVSS score, the impact could be severe, including full device compromise. However, the attack complexity is high, and no active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Due to the high complexity and difficulty of exploitation, immediate urgent action may not be required, but affected organizations should prepare to apply patches once available.