CVE-2026-19750: Tenda CH/CP/TX3 SSH hard-coded password

Description

A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Tenda CH

V21.*affected
V22.*affected
V25.*affected
V26.*affected
V27.*affected

Tenda CP

V21.*affected
V22.*affected
V25.*affected
V26.*affected
V27.*affected

Tenda TX3

V21.*affected
V22.*affected
V25.*affected
V26.*affected
V27.*affected

References

https://vuldb.com/vuln/389501 ↗
https://vuldb.com/vuln/389501/cti ↗
https://vuldb.com/cve/CVE-2026-19750 ↗
https://vuldb.com/submit/868524 ↗
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Camera%20SSH%20Hard-coded%20Password/Tenda%20Camera%20SSH%20Hard-coded%20Password.md ↗
https://www.tenda.com.cn/ ↗