The vulnerability resides in Tenda 4G03 Pro firmware versions 1.0, 1.0re, 01.bin, and 04.03.01.53, where the ECDSA P‑256 private key is hard‑coded in /etc/www/pem/server.key. This allows an attacker to obtain the key or replace the key file, enabling the attacker to impersonate the device in TLS connections, forge certificates, and undermine the integrity of encrypted traffic. The impact is primarily on authentication and confidentiality of communications with the device.

All Tenda 4G03 Pro routers running the affected firmware versions are impacted. The vulnerability is listed by the vendor Tenda and documented for those specific releases.

The CVSS score of 6.9 indicates a medium severity weakness. EPSS information is not available and the vulnerability is not in the KEV catalog, suggesting no widespread public exploit yet. Remote exploitation is possible as the flaw is related to the web administration component and the key file can be accessed over the network. An attacker with network reach to the device could read or replace the static key, then use it to forge TLS certificates or gain unauthorized access.