9.8

CVE-2026-5526: Tenda 4G03 Pro httpd access control

Analyzed
Published 04-04-2026Last modified 06-04-2026

Vulnerability summary

CVE-2026-5526 is a critical (CVSS 9.8) Incorrect Privilege Assignment vulnerability in tenda 4g03_pro_firmware. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
0.65%
0%100%
Low · +0.28 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 04-04-2026
    PublishedVulnerability first disclosed.
  2. 06-04-2026
    Last modifiedVulnerability information updated.

Description

A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVSS metrics

7 scores · 2 sources · 4 versions

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

Increase +0.28 pp

From 0.36% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Tenda1 product
  • 4g03_pro_firmware1.0 | 1.1 | 04.03.01.0 | 04.03.01.1 | 04.03.01.2 | 04.03.01.3 | 04.03.01.4 | 04.03.01.5 | 04.03.01.6 | 04.03.01.7 | 04.03.01.8 | 04.03.01.9 | 04.03.01.10 | 04.03.01.11 | 04.03.01.12 | 04.03.01.13 | 04.03.01.14 | 04.03.01.15 | 04.03.01.16 | 04.03.01.17 | 04.03.01.18 | 04.03.01.19 | 04.03.01.20 | 04.03.01.21 | 04.03.01.22 | 04.03.01.23 | 04.03.01.24 | 04.03.01.25 | 04.03.01.26 | 04.03.01.27 | 04.03.01.28 | 04.03.01.29 | 04.03.01.30 | 04.03.01.31 | 04.03.01.32 | 04.03.01.33 | 04.03.01.34 | 04.03.01.35 | 04.03.01.36 | 04.03.01.37 | 04.03.01.38 | 04.03.01.39 | 04.03.01.40 | 04.03.01.41 | 04.03.01.42 | 04.03.01.43 | 04.03.01.44 | 04.03.01.45 | 04.03.01.46 | 04.03.01.47 | 04.03.01.48 | 04.03.01.49 | 04.03.01.50 | 04.03.01.51 | 04.03.01.52 | 192.168.0.0 | 192.168.0.1 | 04.03.01.53

1 vendor · 1 product

References

4 links