The Tenda 4G03 Pro firmware versions up to 1.0, 1.1, and 04.03.01.53 contain a flaw in the /bin/httpd binary that allows improper access controls to be manipulated. An attacker who can reach the device's web interface can potentially bypass authentication or gain unauthorized administrative capabilities, exposing the router’s configuration and network traffic to compromise.

This issue affects Tenda routers identified as the 4G03 Pro model running firmware versions 1.0, 1.1, and 04.03.01.53. The device is typically accessed via the default local IP of 192.168.0.1 and is intended to be managed over a LAN or VPN. No other vendor or product variants are explicitly listed.

The CVSS score of 6.9 indicates moderate severity, and though EPSS data is missing, the fact that a public exploit is available and the attack can be carried out remotely elevates the real‑world risk. Attackers need only network access to the device’s web interface; no credentials or special knowledge are required beyond a standard web request. The vulnerability is not included in CISA’s KEV catalog, but the public nature of the exploit suggests that it could be widely used once discovered.