A researcher known as Low Level bought the wrong Tenda router, got the AC10V6 instead of the target for CVE-2026-11405, and then rooted it anyway using a three-CVE chain. The attack combines CVE-2025-9090, which enables Telnet on Tenda's AC20 by touching a single file, with CVE-2025-52054, which derives the root password from a static string and the last two octets of the device MAC address. Tenda encrypted the AC10V6 firmware, which looked like a defense but turned out to be irrelevant.
The static string needed for CVE-2025-52054 was unknown for the AC10V6, and the AC8 variant did not work. Tenda solved this problem themselves: the router prints the pre-Base64 password directly to its UART serial output on boot. One hard reset and a UART probe later, the string read '9cUFeUZC_125700'. Base64-encoding it and submitting it to the newly enabled Telnet service gave root. Root access then handed over the decrypted firmware and the encryption keys that had blocked static analysis from the start.
The full technical writeup, including the decryption keys, is pending legal review before publication. What makes this worth reading in full is not the endpoint but the methodology: how encrypted firmware created a false sense of security, how prior research on a different Tenda model (the AC20) transferred directly, and how Tenda's own serial debug output defeated its own obfuscation. The CVE trail here is a practical map of how budget router security fails in layers.
[READ ORIGINAL →]