CVE-2026-5526

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266CWE-284

Affected software

VendorProductVersions
Tenda4G03 Pro1.0; 1.1; 04.03.01.0; 04.03.01.1; 04.03.01.2; 04.03.01.3; 04.03.01.4; 04.03.01.5; 04.03.01.6; 04.03.01.7; 04.03.01.8; 04.03.01.9; 04.03.01.10; 04.03.01.11; 04.03.01.12; 04.03.01.13; 04.03.01.14; 04.03.01.15; 04.03.01.16; 04.03.01.17

References

Timeline

Published
Apr 4, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-552618.4In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This CVE-2026-552628.4In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization dueCVE-2026-552638.4In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading oCVE-2026-552644.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead CVE-2026-552656.5In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote dCVE-2026-552667.8In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalatioCVE-2026-552697.8In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to locCVE-2026-55275.3A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the fCVE-2026-552707.8In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation oCVE-2026-552718.4In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This cCVE-2026-552726.2In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local CVE-2026-552737.8In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to
CVE-2026-5526: Critical severity, CVSS 9.8 | Vulnix