This vulnerability affects Tenda 4G03 Pro devices running specific firmware versions and arises from the use of a hard-coded cryptographic key within the ECDSA P-256 Private Key Handler, located in the /etc/www/pem/server.key file. The presence of a hard-coded key can undermine cryptographic security, potentially allowing an attacker to compromise cryptographic operations remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, and no privileges or user interaction required. No vendor advisory or patch information is currently available.

The use of a hard-coded cryptographic key may allow remote attackers to bypass cryptographic protections, potentially compromising confidentiality or integrity of communications or authentication mechanisms relying on this key. However, the exact impact scope is not detailed beyond the cryptographic weakness. No known exploits have been reported in the wild, and no privilege or user interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of affected devices to untrusted networks and monitor for updates from Tenda. No official mitigation or workaround is currently documented.