{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nvr_4h-v27.5.58.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:tenda:nvr_4h:v27.5.58.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-79551"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NVR_4H (V27.5.58.6)"],"_cs_severities":["medium"],"_cs_tags":["iot","cve","mitm","firmware"],"_cs_type":"advisory","_cs_vendors":["Tenda"],"content_html":"\u003cp\u003eTenda NVR_4H network video recorders running firmware V27.5.58.6 include a static, hardcoded ECDSA private key and self-signed certificate within the read-only \u003ccode\u003euser-x.squashfs\u003c/code\u003e filesystem. Because this key is identical across all devices and is publicly accessible within the downloadable firmware image, any attacker can extract the private key. This allows an attacker on the same network to intercept, decrypt, and modify HTTPS management traffic without triggering browser warnings. The vulnerability is identified as CVE-2026-79551 and CNVD-2026-25884.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker downloads the publicly available NVR_4H firmware image (V27.5.58.6) from Tenda.\u003c/li\u003e\n\u003cli\u003eAttacker unpacks the firmware container using standard tools (e.g., binwalk, unsquashfs).\u003c/li\u003e\n\u003cli\u003eAttacker extracts the hardcoded private key (\u003ccode\u003e/etc/privkey.pem\u003c/code\u003e) and certificate (\u003ccode\u003e/etc/cacert.pem\u003c/code\u003e) from the squashfs partition.\u003c/li\u003e\n\u003cli\u003eAttacker positions themselves on the network segment as the NVR_4H administrator (via ARP spoofing or DNS poisoning).\u003c/li\u003e\n\u003cli\u003eAttacker intercepts the TLS connection between the admin's browser and the NVR using the extracted private key to decrypt and present the legitimate-looking certificate.\u003c/li\u003e\n\u003cli\u003eAttacker performs real-time traffic manipulation to capture administrator credentials, session tokens, and camera RTSP credentials.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized administrative access to the recorder and connected surveillance cameras.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the complete loss of confidentiality and integrity for the HTTPS management interface. An attacker can perform a passive man-in-the-middle attack to harvest credentials or modify system configuration, granting full control over the surveillance infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Tenda NVR_4H units within the environment and confirm their firmware version.\u003c/li\u003e\n\u003cli\u003eIsolate vulnerable NVR_4H devices from untrusted network segments or external exposure until a patch is available.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation to minimize the risk of ARP spoofing or MITM attacks targeting management traffic.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized ARP traffic or anomalous network configuration changes within segments hosting NVR devices.\u003c/li\u003e\n\u003cli\u003eContact Tenda support to inquire about firmware updates or patches that remove the hardcoded key material and implement per-device provisioning.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T05:59:39Z","date_published":"2026-10-29T05:59:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tenda-nvr-hardcoded-keys/","summary":"Tenda NVR_4H firmware version V27.5.58.6 contains a hardcoded ECDSA private key and self-signed certificate in the read-only partition, enabling full TLS session interception via man-in-the-middle attacks.","title":"Tenda NVR_4H: Hardcoded TLS private key vulnerability (CVE-2026-79551)","url":"https://feed.craftedsignal.io/briefs/2026-10-tenda-nvr-hardcoded-keys/"}],"language":"en","title":"CraftedSignal Threat Feed - NVR_4H (V27.5.58.6)","version":"https://jsonfeed.org/version/1.1"}