CVE-2026-38577: n/a

This vulnerability (CVE-2026-38577) is due to insecure hardcoded credentials in the Admin account of Tenda HG21 version 4.0.0-260302. An attacker can exploit this to gain root access remotely without authentication. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical impact with full control over the device. No known exploits are reported in the wild, and no vendor patch or mitigation details have been published yet.

Successful exploitation grants an attacker root-level access to the affected device, compromising confidentiality, integrity, and availability. This could allow full control over the router, potentially leading to network compromise or further attacks on connected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for unauthorized access attempts. Avoid exposing the device to untrusted networks.