This vulnerability in Tenda AC10 firmware 16.03.10.10_multi_TDE01 arises from the use of a hard-coded RSA 2048-bit private key within the component responsible for private key handling. The key is embedded in the file /webroot_ro/pem/privkeySrv.pem. An attacker can remotely manipulate the device to leverage this hard-coded key, potentially compromising cryptographic operations that rely on it. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

The use of a hard-coded cryptographic key can undermine the security of cryptographic functions, potentially allowing an attacker to decrypt sensitive data, impersonate the device, or bypass security mechanisms relying on the key. Since the attack can be launched remotely without authentication, the vulnerability increases the risk of unauthorized access or manipulation. However, the impact on confidentiality is rated low, and no integrity or availability impacts are noted. No known exploits in the wild have been reported so far.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, affected users should consider limiting remote access to the device and monitor for updates from Tenda. Avoid exposing the device to untrusted networks where possible.