Tenda AC10V6 Router Hacked via Three-CVE Chain and UART Pins

An enthusiast going by the handle Low Level, preparing a piece on the known CVE-2026-11405 flaw in Tenda routers, accidentally purchased the AC10V6 model instead of the intended target. Rather than shelving the device, he decided to hunt for vulnerabilities in this version as well, ultimately achieving full root access.

The first obstacle was that the AC10V6 firmware turned out to be encrypted, blocking standard analysis with binwalk and Ghidra. The researcher then turned to work by others on different Tenda models. For the AC20, a vulnerability designated CVE-2025-9090 was documented, enabling Telnet activation by simply touching a file on the system. However, logging into Telnet required a password, and another known flaw, CVE-2025-52054, proved useful here.

That vulnerability describes a method for deriving the root password from a static string and the last two octets of the device's MAC address. The catch was that for the AC10V6 this string was unknown, and the version from the AC8 did not work. Unexpectedly, it turned out that Tenda prints secret data to the serial port, so the author had to open the case and connect to the UART pins.

After a factory reset, the console output on these pins revealed that the pre-Base64 password was 9cUFeUZC_125700. Entering the Base64-encoded string into Telnet granted root access, along with the decrypted firmware and its decryption keys. Low Level plans to publish details, including the keys, in a blog post after consulting with his lawyer.

The outcome was that a chain of three vulnerabilities—encrypted firmware, a Telnet backdoor, and a derivable password—allowed full compromise of the device. This story serves as a clear example of why Tenda routers should not be trusted in sensitive environments.