The Tenda AX12 Pro V2 router is susceptible to unauthorized access due to hard-coded credentials in the Telnet service, posing a critical risk to network security.

The device uses hard-coded credentials within its Telnet service implementation. This flaw allows an unauthenticated remote attacker to potentially bypass standard authentication mechanisms if they can reach the service.

Successful exploitation of this vulnerability grants an attacker full control over the affected network device. Given the CVSS score of 8.1, the business impact is severe, as it enables unauthorized access to internal network traffic, potential interception of sensitive data, and the ability to pivot into the local area network. This compromise could lead to significant operational disruption and a breach of organizational data privacy.

Immediate Action: Disable the Telnet service on the Tenda AX12 Pro V2 immediately and restrict management access to trusted interfaces only.

Proactive Monitoring: Review device logs for unauthorized login attempts or unexpected Telnet session activity originating from unknown IP addresses.

Compensating Controls: Implement network segmentation to isolate the affected router from the primary business network and utilize firewall rules to block external access to the Telnet port.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research documentation provided in the vulnerability record.

Given the severity of hard-coded credentials and the availability of a public proof-of-concept, users must prioritize securing the management interface of their Tenda devices. Administrators should disable Telnet immediately and await further guidance from the vendor regarding a firmware update to remove the hard-coded credentials.