The flaw resides in Tenda AX12 Pro V2’s telnet service, where valid login credentials are hard‑coded into the firmware. This allows an attacker to authenticate without knowledge of a correct password, satisfying CWE‑259 and CWE‑798. Once authenticated, the attacker gains the full privileges of the device, enabling configuration changes, firmware modifications, or use as a foothold for further network exploitation, thereby compromising confidentiality, integrity, and availability.

Firmware 16.03.49.24_cn of the Tenda AX12 Pro V2 router is impacted. The vulnerability is associated with the telnet component of the device, which is enabled by default in the mentioned firmware version.

The CVSS base score of 9.2 classifies this issue as critical, and although the EPSS score is below 1%, the publicly available exploit script implies that a determined adversary can exploit the flaw remotely. The intruder must first discover the device, enable telnet if disabled, and then use the known credentials. Despite the high complexity, the low exploitation probability does not mitigate the critical nature of the vulnerability, and the absence from the KEV list does not reduce the urgency of remediation.