Description

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T21:17:07.930Z",
  "pubdate": "2026-08-31T21:17:07.930Z",
  "executiveSummary": "The Tenda HG21 V4.0.0-260302 is susceptible to an authentication bypass vulnerability stemming from the use of hardcoded credentials within the administrative interface. This vulnerability is classified as an improper authentication flaw, enabling unauthorized actors to gain elevated root-level access to the device's operating environment. The presence of static, immutable credentials exposes the system to complete compromise, as the administrative account can be accessed by any user with knowledge of the embedded password. The risk implication is critical, as successful exploitation facilitates full administrative control over the network device, allowing for unauthorized configuration changes, traffic interception, and further propagation within the local network. No complex exploitation maneuvers are required; an attacker merely needs to provide the valid hardcoded credentials during the standard login procedure. This lack of credential rotation or unique per-device authentication mechanisms significantly diminishes the security posture of the affected unit, rendering traditional authentication controls ineffective.",
  "technicalDetails": "The vulnerability resides within the Tenda HG21 firmware version V4.0.0-260302, specifically concerning the implementation of the administrative authentication module. The root cause is the inclusion of hardcoded administrative credentials within the device firmware, which functions as a static authentication back-door. Because these credentials are not unique to individual devices and are embedded directly into the binary, they cannot be remediated or rotated through standard user-level administrative changes.\nThe exploitation method involves a standard authentication request directed at the device's administrative web interface. An attacker does not need to perform complex memory corruption or exploit service overflows; they simply utilize the hardcoded username and password pair to authenticate against the web management service. Upon successful submission of these credentials, the authentication logic returns a valid session token, granting the attacker full administrative privileges.\nThe attack flow follows a direct path: First, the attacker initiates a connection to the web administration port of the Tenda HG21. Second, the attacker interacts with the login endpoint, providing the discovered hardcoded credentials. Third, the internal authentication handler compares the provided input against the hardcoded string constants within the firmware. Upon a successful match, the application creates an authenticated session context for the 'root' or 'admin' user profile.\nPost-exploitation, the impact is severe. An attacker attaining root access possesses the capability to modify device configurations, adjust routing tables, intercept traffic, disable firewall rules, or perform arbitrary command injection if additional management functions permit shell interaction. Furthermore, root access allows for the persistence of the compromised state through firmware modification or the installation of malicious backdoors. The vulnerability exists within the device's primary management web component, which is typically accessible via the local network interface, or potentially externally if the administrative panel is exposed to the WAN. Given the static nature of the credentials, all units running V4.0.0-260302 are equally vulnerable to unauthorized access, regardless of the password policies enforced by the actual user."
}