CVE-2026-86150: Hard-coded Credentials in Tenda CP3

This vulnerability affects Tenda CP3 firmware version 27.5.57.101 and involves hard-coded credentials due to manipulation of the wpa_passphrase argument in the file custom-x/softap/hostapd. The flaw can be exploited remotely, potentially allowing unauthorized access. The CVSS 4.0 base score is 5.1 (medium severity), with network attack vector, low complexity, no privileges required for attack initiation, no user interaction, and low impact on confidentiality and security requirements. The vulnerability has been publicly disclosed but no known exploits in the wild have been reported. No patch or vendor advisory is currently available.

The vulnerability allows remote attackers to exploit hard-coded credentials in the device, potentially leading to unauthorized access or control. The impact is rated medium severity with limited confidentiality and security impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific mitigations are provided in the available data.