This vulnerability in Tenda AC10 firmware version 16.03.10.10_multi_TDE01 arises from the use of a hard-coded RSA 2048-bit private key in the component handling cryptographic operations, specifically located in /webroot_ro/pem/privkeySrv.pem. An attacker can remotely manipulate the device to leverage this hard-coded key, potentially compromising cryptographic security. The CVSS 4.0 base score is 6.9, indicating medium severity, with attack vector network, low complexity, no privileges or user interaction required, and partial impact on confidentiality. The vulnerability is publicly disclosed but no vendor remediation or patch is currently available.

The use of a hard-coded cryptographic key can undermine the security of encrypted communications or authentication mechanisms relying on this key. An attacker exploiting this vulnerability remotely could potentially decrypt sensitive data or impersonate the device. However, the impact is rated medium, and there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided by the vendor at this time.