CVE-2026-38571 describes a vulnerability in the Tenda N300 F3 (V603) router where WPA2 credentials are stored and exposed in cleartext through an unauthenticated UART debug console. The console also permits unauthenticated memory read and write operations via rr/wr commands. An attacker with physical proximity and access to the serial console can exploit this to obtain sensitive credentials and manipulate memory arbitrarily. No patch or official remediation has been documented as of the published date.

An attacker with physical access to the device's UART debug console can retrieve WPA2 credentials in cleartext, compromising network security. Furthermore, the attacker can read or write arbitrary memory, potentially leading to further unauthorized actions or device manipulation. There is no indication of remote exploitation; physical proximity is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the device and disable or secure the UART debug console if possible.