Tenda AC10U V1.0 (AC10U)
From Wiki-IoT
| Tenda AC10U V1.0 (AC10U) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Tenda AC10U
Brand: Tenda (Parent: Shenzhen Tenda Technology Co., Ltd.) Category: Router • Model / Gen: AC1200 AC10U V1.0 Release Date: 2018-01-01 • Status: In sale Classification Date: 2026-10-24 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Plastic case with screws; no public mass-tampering campaign found for this model. FCC/teardown evidence still to be checked. |
| Known vulnerabilities | Very common | 🔗 Proof | CVE-2021-45401: command injection via setUsbUnload in AC10U V1.0 firmware V15.03.06.49_multi, CVSS 9.8. Other AC10U CVEs should be added after a full NVD check. |
| Prior attacks | Rare | 🔗 Proof | No AC10U-specific botnet campaign found; router class is a common Mirai target, so Rare rather than None. |
| Updatability | Rare | 🔗 Proof | Tenda publishes firmware downloads, but this model's update cadence is irregular; verify the latest firmware before scoring. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Web admin uses a local password; no mutual authentication or SSO with other systems. |
| Communications | No encryption | 🔗 Proof | Admin UI is HTTP in the default configuration; confirm whether HTTPS is available in the current firmware. |
| Storage | No encryption | 🔗 Proof | Configuration backup is not documented as encrypted; verify by exporting a config file. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Single admin account; no role separation or user lifecycle management. |
| Authentication | Basic | 🔗 Proof | Password-only web login; no MFA. |
| Brute-force protection | Absent | 🔗 Proof | No account lockout or rate limit is documented; verify with the current firmware. |
| Event logging | Partial logging | 🔗 Proof | Basic system log exists; no central audit trail. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Default admin password is not forced to change at first login; verify against the manual for the exact firmware. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Tenda firmware (Companion App: Tenda WiFi) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Gigabit Ethernet, Wi-Fi 2.4/5 GHz |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Tenda AC10U is an AC1200 dual-band wireless router with Gigabit Ethernet ports. It is managed through a local web interface and the Tenda WiFi app. The model has a publicly documented command-injection vulnerability in firmware V15.03.06.49_multi (CVE-2021-45401, CVSS 9.8).
