CVE-2026-86150

Executive Summary

CVE-2026-86150 is a hard-coded credential vulnerability (CWE-259) discovered in the Tenda CP3 embedded system, firmware version 27.5.57.101. Affected systems include any deployed Tenda CP3 devices running this firmware. The flaw resides in the handling of the wpa_passphrase argument within the file custom-x/softap/hostapd, where the embedded credential is hardcoded rather than user-configurable or generated with sufficient entropy. Although the vulnerability is remotely exploitable, the CVSS score is 4.1 (medium severity) because exploitation requires high privileges, limits the confidentiality impact to low, and does not affect system integrity or availability. Due to a publicly disclosed exploit, active exploitation should be considered probable.

Technical Analysis

The vulnerability class is hard-coded credentials (CWE-259). In the context of the Tenda CP3 device, the file custom-x/softap/hostapd implements the software access point (SoftAP) via the hostapd daemon — a widely used IEEE 802.11 access point and authentication server daemon. Hostapd configuration files typically specify a pre-shared key (PSK) parameter (wpa_passphrase) that is used to generate the pairwise master key for WPA/WPA2/WPA3 authentication in the softAP network.

The NVD description states that "manipulation of the argument wpa_passphrase leads to hard-coded credentials." This indicates that the credential is embedded in the firmware/configuration in a static, predictable manner. The exact implementation detail is not disclosed — the data provided does not reveal whether the passphrase is identical across all devices, derived from a predictable seed (such as serial number or MAC address with a known algorithm), or modifiable only through a fixed value that is publicly known. However, the exploitation vector being remote suggests that an attacker can read or influence the value of wpa_passphrase without local access.

The attack surface includes any network-facing interface that allows a remote actor with high privileges to reach the vulnerable parameter. This could be a management interface, an API endpoint, or a diagnostic function. Since the CVSS vector indicates PR:H (High privileges required), the attacker already requires elevated access to the device's management plane.

Important constraints from the data: insufficient technical detail is available on the exact mechanism of how the hard-coded credential is exposed, whether it is derivable over the network, or what the specific credential value is. Furthermore, no patch evidence exists from any tracked source, and the affected version range is limited to 27.5.57.101. Insufficient technical detail is available to describe the specific function names, memory layout, or surrounding code.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (hard-coded credentials on a WPA passphrase) and the CVSS vector.

1. Reconnaissance/Target Identification: The attacker identifies Tenda CP3 devices remotely by scanning for characteristic softAP SSIDs, telnet/SSH/tcp ports, or the web management interface on the LAN or via a cloud-based management channel. Devices running firmware version 27.5.57.101 are the target. The attacker verifies reachability of the management interface.

2. Triggering the Flaw: An attacker with high-level privileges (e.g., an authenticated administrator account, or a user who has escalated to an admin-level session through a separate primary vulnerability) interacts with the function that reads the file custom-x/softap/hostapd. Specifically, the attacker supplies or inspects the argument wpa_passphrase. Because the credential is hard-coded, the system accepts the known, static value rather than enforcing a user-supplied unique passphrase. The attacker does not need to brute-force the passphrase since it is derived from the public constant embedded in the firmware image.

3. Execution at the Vulnerability-Class Level: At the class level, the attacker induces the device to expose or accept the known passphrase. This could manifest as: (a) reading the passphrase from an information-disclosure endpoint, (b) authenticating to the softAP network using the known passphrase, allowing unauthorized joining of the wireless network, or (c) passing the hardcoded value to an API where it is accepted, thereby authorizing an action that should require a secret known only to the device owner.

4. Post-Exploitation Impact: With a successful connection to the wireless network (softAP), the attacker gains network-level access to the device's LAN segment. This could allow the attacker to pivot toward other internal resources, intercept traffic, or leverage the device as a foothold for lateral movement. The CVSS scope change (S:C) indicates that the compromise of the CP3 device can extend the impact beyond the device itself, affecting other resources in the network. However, the confidentiality impact is limited to low (C:L), suggesting only partial information disclosure. Integrity and availability are unaffected.

Impact Assessment

The business impact of CVE-2026-86150 should be evaluated in the context of where Tenda CP3 devices are deployed. CP3 is a home/small-office grade wireless router product line. In an enterprise context, such devices may appear in edge deployments, guest networks, or remote-office configurations. If deployed on the corporate perimeter, exposure of the softAP passphrase could provide an unauthenticated (from the network's perspective) entry point into the wireless network.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N breaks down as follows:

• Attack Vector (N): Network-based attack; no physical access needed.
• Attack Complexity (L): No special attack conditions required.
• Privileges Required (H): An attacker must already possess high-level privileges on the device.
• User Interaction (N): No user action required.
• Scope (C): The impact extends beyond the vulnerable component — the compromised device can affect other systems.
• Confidentiality (L): Limited information disclosure; the exposed passphrase could leak the Wi-Fi secret.
• Integrity (N) / Availability (N): Data cannot be altered; the device is not taken offline.

The blast radius is primarily the wireless network segment broadcast by the softAP. If the softAP is bridged to the LAN rather than isolated, the hardcoded passphrase grants an attacker direct entry to the internal network. Because exploitation requires high privileges, the attack is most likely chained after an earlier compromise — for example, gaining admin access to the router's web management panel or obtaining SSH credentials via another vuln. This reduces the severity but does not negate the risk, as the hardcoded credential is used across multiple devices, making it a stable post-exploitation persistence and lateral-movement enabler.

Detection Guidance

Sigma Rule

title: Tenda CP3 Hostapd WPA Passphrase Hardcoded Credential Attempt
id: 8f14e45f-8f72-4d9e-9f31-4f9a8b6c1d2e
status: experimental
description: Detects attempts to modify or read the hostapd configuration file (custom-x/softap/hostapd) or events referencing the wpa_passphrase parameter on Tenda CP3 devices.
logsource:
    category: process_creation
    product: linux
detection:
    selection_hostapd:
        Image|endswith: '/hostapd'
        CommandLine|contains: 'wpa_passphrase'
    selection_config_access:
        FileName|contains: 'custom-x/softap/hostapd'
    condition: selection_hostapd or selection_config_access
falsepositives:
    - Legitimate administrative reconfiguration of the softAP by an authorized device administrator
level: medium

YARA Rule

rule Tenda_CP3_Hardcoded_Passphrase {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects strings referencing Tenda CP3 hostapd configuration and hardcoded wpa_passphrase"
        cve = "CVE-2026-86150"
        date = "2026-01-XX"
    strings:
        $a = "custom-x/softap/hostapd" ascii wide nocase
        $b = "wpa_passphrase" ascii wide nocase
        $c = "Tenda CP3" ascii wide nocase
        $d = "27.5.57.101" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
        or (all of them)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-86150 Tenda CP3 hostapd wpa_passphrase hardcoded credential attempt"; content:"wpa_passphrase"; nocase; content:"hostapd"; nocase; distance:0; http_uri; flow:to_server,established; classtype:attempted-admin; sid:86815001; rev:1; reference:cve,2026-86150;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.action == "executed" and process.name == "hostapd" and process.args == "wpa_passphrase"]
  [file where event.action == "modification" and file.name == "hostapd" and file.path contains "custom-x/softap"]

Splunk SPL Query

index=linux sourcetype=syslog OR sourcetype=linux_secure
(process="*hostapd*" AND process="*wpa_passphrase*")
OR (file_path="*custom-x/softap/hostapd*" AND (action=write OR action=read))
| stats count by host, src_ip, user, process
| sort - count

Wazuh OSSEC Rule

<group name="tenda,">
    <rule id="868150" level="10">
        <if_sid>5710</if_sid> <!-- Base rule for process execution on Linux -->
        <field name="file">\.*(custom-x/softap/hostapd).*</field>
        <match>wpa_passphrase</match>
        <description>CVE-2026-86150 - Tenda CP3 hostapd configuration tampering: wpa_passphrase manipulation detected.</description>
        <group>access_control,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations:

   • Segment the softAP: Configure the Tenda CP3 so that the softAP network is isolated (guest network or VLAN) from the primary LAN. This limits the lateral movement blast radius if the passphrase is compromised.
   • Disable the softAP: If the access point function is not business-critical, disable it entirely via the device management interface.
   • Restrict management access: Ensure the CP3 management interface (web/SSH) is not exposed to the untrusted internet — block inbound access at the firewall/perimeter.
   • Change network secrets: Rotate the WPA passphrase for any network that relies on the CP3, and treat the current passphrase as compromised.

2. Patch/Upgrade Steps:

   • Consult the Tenda vendor support portal for any firmware update beyond version 27.5.57.101. As of this report, no patch or fix evidence exists from any tracked source.
   • Prior to deploying any new firmware, verify its integrity via a vendor-provided checksum or signature.
   • Monitor Tenda security advisories, and consider placing the device on a scheduled re-assessment list.

3. Long-Term Hardening:

   • Replace end-of-life or long-unpatched embedded devices with enterprise-grade access points that receive regular security fixes.
   • Implement a network access control (NAC) policy for wireless endpoints.
   • Ensure monitoring of the wireless control plane (e.g., WIDS/WIPS) is in place so that an unexpected association to the softAP is flagged.
   • Perform periodic credentialed audits of all network edge devices to identify hardcoded credentials and default configurations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-86150 (Official NVD record — note: this is the standard NVD URL format for the provided CVE ID).
2. CWE-259 Use of Hard-coded Password: https://cwe.mitre.org/data/definitions/259.html
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-86150 is NOT listed (KEV: NO).
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. FIRST.org EPSS — not yet scored for CVE-2026-86150: https://www.first.org/epss/

Threat actor campaign / exploit-in-the-wild evidence: The NVD description confirms that an exploit has been publicly disclosed, increasing the probability of in-the-wild exploitation. However, no specific threat actor campaigns or cybercrime/APT group attributions have been linked to this CVE in the provided data.