A flaw in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 permits an attacker to manipulate the /webroot_ro/pem/privkeySrv.pem file, causing the device to use a hard‑coded 2048‑bit RSA private key. Based on the description, it is inferred that the attacker could potentially decrypt or sign traffic, thereby compromising data confidentiality and integrity. This usage violates cryptographic best practices and could lead to unauthorized control over secure communications to and from the device.

The vulnerability affects all Tenda AC10 routers running firmware 16.03.10.10_multi_TDE01. No other firmware revisions are listed as impacted; therefore, devices with older or newer firmware versions are not known to be affected.

The CVSS score of 6.9 indicates moderate severity. EPSS is unavailable and the issue is not recorded in CISA’s KEV catalog. The description states that the attack can be launched remotely and an exploit has been publicly disclosed. Based on the description, it is inferred that the attack does not require privileged local access, meaning that a remote attacker could potentially exploit the flaw with limited or no authentication.