A flaw in the Shenzhen Tenda AC7 firmware V03.03.03.01_cn and earlier releases causes administrative usernames and passwords to appear in clear text within HTTP responses, thereby leaking credentials to anyone who observes the traffic. This credential exposure allows an attacker on the same network to obtain administrative access to the device, which could be used to examine or change device settings. The weakness is a clear‑text transmission issue (CWE‑319).

Devices: Shenzhen Tenda Technology Co., Ltd. Tenda AC7 router, firmware version V03.03.03.01_cn and all earlier releases. The issue has been documented for the AC7 hardware line.

The vulnerability carries a CVSS v3.1 score of 8.2, indicating high severity. Exploit probability is reported as less than 1 %, suggesting active exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to passively intercept unencrypted HTTP traffic on the local network; no special privileges on the device are required. Successful interception yields the router’s administrative credentials, which could allow an attacker to gain unauthorized administrative access to the device. The likely attack vector is network sniffing on the local machine.