CVE-2026-86150: Tenda CP3 hostapd hard-coded credentials
Published Sep 5, 2026
·Updated
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
1 affected component
Tenda CP3=27.5.57.101
Event History
Sep 5, 2026
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be launched remotely and has low attack complexity, but it requires high privileges. No user interaction is required.
2
Which deployments are known to be affected?
The affected product identified is Tenda CP3 running version 27.5.57.101. The available information does not state whether other versions or default configurations are affected.
3
How likely is exploitation?
A public exploit has been disclosed and may be used. The exploitability assessment is marked as proof-of-concept.