CVE-2026-5526: Tenda 4G03 Pro httpd improper access control
A flaw in the httpd component (/bin/httpd) of Tenda 4G03 Pro devices allows improper access control (CWE-266) and can be exploited remotely, according to the VulDB record. NVD assigns a 9.8 score, while VulDB scores in the sources consulted are lower and vary by version. The record states that an exploit has been made public, but CISA KEV does not list this CVE and the record provides no fixed version.
Overview
CVE-2026-5526 is an improper access control issue (CWE-266) in the httpd binary (/bin/httpd) of the Tenda 4G03 Pro router. The record was published on 2026-04-04 and assigned by VulDB. The description refers to an unspecified function of httpd and does not explain the technical root cause.
Impact
- The record describes improper access controls that may be reachable remotely.
- NVD's CVSS 3.1 base score is 9.8 (critical), and its vector indicates network attack vector, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact.
- VulDB's scores in the record are lower (6.9 and 5.5 under version 4.0 and 7.3 under version 3.1 for its own entries), so the severity depends on the scoring source used.
- The actual consequences of exploitation are not described in the sources consulted and should be treated as unknown.
Affected products and versions
- The product entry lists Tenda 4G03 Pro with many version strings, and a separate firmware entry lists version 04.03.01.53.
- The description limits the affected scope to versions up to 1.0/1.1/04.03.01.53/192.168.0.1.
- The record provides no fixed version, so the status of newer firmware is unknown.
- Operators should confirm the exact firmware build on each device against the vendor's current release notes at Tenda.
Exploitation status
- The description states that an exploit has been released to the public and may be used for attacks.
- CISA KEV does not list this CVE, and the record's SSVC data reports exploitation as none.
- No confirmed active exploitation in the wild appears in the sources consulted.
- EPSS gives a probability of about 0.00645 (percentile about 0.50297), which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- No vendor fix is listed in the record. Check the vendor website for firmware updates and apply any update that addresses this issue once it is confirmed.
- Until a fix is verified, restrict access to the device's management interface, avoid exposing it to the internet, and place it behind a firewall or VPN.
- Replace unsupported devices where the vendor no longer provides updates.
Detection guidance
- Review device and perimeter logs for unexpected management-interface access, especially from external addresses.
- Monitor for configuration changes or new administrative accounts that were not authorized.
- Inventory all Tenda 4G03 Pro units and their firmware builds to find exposed or outdated devices.
Limitations of the available information
- The record does not identify the vulnerable function, the request path, or the precise access control check that fails.
- No fixed version, vendor advisory, or patch is linked in the record.
- Scores differ across NVD and VulDB and across CVSS versions.
- The record's list of affected versions is broad and includes entries that may not all be vulnerable; the description's range is the more specific statement.
Frequently asked questions
Is CVE-2026-5526 being actively exploited?
CISA KEV does not list this CVE and the record's SSVC data reports no exploitation. The description says a public exploit exists, but no confirmed active exploitation appears in the sources consulted.
Is there a fixed version for this vulnerability?
The record does not list any fixed version. Check the vendor's current firmware releases and apply an update once it is confirmed to address this issue.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.