CVE-2026-5526 is a high severity improper access control flaw (CVSS 7.3) in the Tenda 4G03 Pro router, in the /bin/httpd binary. It can be attacked remotely, and the record says an exploit has been released publicly. No fixed firmware is listed, so limit exposure of the management interface and ask the vendor.
What's affected
- Tenda 4G03 Pro firmware up to 1.0/1.1/04.03.01.53, per the record.
- Fixed version: none listed in the record. The references are VulDB entries and the Tenda site, and none of them named a patched firmware.
- The weakness is in the web server component /bin/httpd, and the record does not name the exact function.
How to check if you're exposed
Log in to the router and read the firmware version on the status or system page. If it matches 04.03.01.53 or an earlier version in the list, treat it as affected. Then check whether the web management page is reachable from the internet or from untrusted internal networks. A management page that only answers on a trusted LAN is much harder to reach.
What to do now
- Check the Tenda site for a firmware update, and apply one if the vendor lists a fix for this issue.
- Turn off remote web management, and limit LAN access to the admin page to one trusted host.
- Change the administrator password to a strong, unique one.
- If no fix appears, plan to replace the device on a sensible timeline, especially if it fronts anything important.
- Keep an eye on the VulDB entry for updates.
Why it matters
The classes are CWE-266, CWE-284: improper privilege management and improper access control. A request to the device web server is handled in a way that does not enforce the checks it should. The record does not describe the request, and this post does not either.
The record says the exploit is public, which raises the odds of attempts against exposed devices. It does not say the CVE is on the CISA Known Exploited Vulnerabilities list. Small office routers often have no automatic updates and long lifetimes, so network placement does the real work of protection.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is there a patch?
None is listed in the record. Check the vendor site and VulDB for news.
Sources
Last reviewed: 19 October 2026.
