This vulnerability concerns the use of a hard-coded cryptographic key within the Tenda 4G03 Pro router's ECDSA P-256 Private Key Handler, affecting certain firmware versions. The hard-coded key is located in the file /etc/www/pem/server.key. Because the key is embedded and static, it may allow an attacker to compromise cryptographic operations that rely on this key. The vulnerability is remotely exploitable without requiring user interaction or privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction needed, and low impact on confidentiality. No vendor advisory or patch information is currently available.

The use of a hard-coded cryptographic key weakens the cryptographic security of the device, potentially allowing attackers to bypass authentication or decrypt sensitive communications relying on the compromised key. Since the vulnerability is remotely exploitable without privileges or user interaction, it increases the attack surface. However, the CVSS score and vector suggest limited impact on confidentiality and no impact on integrity or availability. No known exploits have been reported in the wild, indicating limited current exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. If possible, consider restricting remote access to the affected device to trusted networks only to reduce exposure. Avoid deploying affected firmware versions in sensitive environments until remediation is available.