Hacking a Tenda AC1200 Wi-Fi Router with a CVE Combo
The article details a security researcher’s attempt to exploit a Tenda AC10V6 router after initially targeting a different model. By analyzing the encrypted firmware and leveraging known CVEs, the researcher accessed the device’s UART to retrieve a Base64‑encoded password, which granted root access via Telnet. The findings highlight multiple vulnerabilities in Tenda routers and suggest caution when using them.
- ▪The researcher downloaded the router’s firmware and used tools like binwalk and Ghidra to examine its contents despite encryption.
- ▪A Telnet exploit (CVE‑2025‑9090) and a password‑derivation method (CVE‑2025‑52054) were employed to attempt login.
- ▪Serial console output revealed a Base64‑encoded password, which when decoded allowed root access.
- ▪The author plans to publish further details after legal review, emphasizing the severity of the vulnerabilities.
Hackaday files mainly under tech. We currently carry 278 of its stories.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | Hackaday |
| Canonical URL | https://hackaday.com/2026/08/05/hacking-a-tenda-ac1200-wi-fi-router-with-a-cve-combo/ |
| Publication time | Thu, 06 Aug 2026 05:00:08 +0000 |
| Retrieval time | 2026-08-06T05:00:41.876Z |
| Last seen | 2026-08-06T05:00:41.876Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | bHSock3mz0AU · 1 stories |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
Hacking A Tenda AC1200 Wi-Fi Router With A CVE Combo No comments by: Maya Posch August 5, 2026 Title: Copy Short Link: Copy It’s rather awkward when you buy a piece of hardware like a sketchy router to make a video about its hidden admin password backdoor – known as CVE-2026-11405 – only to discover that you bought the wrong Tenda router, namely the AC10V6 model. After making this mistake, [Low Level] did the only reasonable thing one ought to do in this case, and try to find an exploit in this ‘wrong’ router as well. The obvious start here is to do the same as with the other exploit, in that you download a firmware image from the manufacturer’s website, then pluck it apart using binwalk to do an initial check for juicy files.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Hackaday.
Discussion
0 commentsMore from Hackaday
