CVEvulnerability
CVE-2026-4252
8.9 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.9 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287, CWE-291
Description
A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Affected configurations
• tenda ac8 firmware 16.03.50.11
Related
References
- https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py Exploit
- https://vuldb.com/?ctiid.351210 Permissions Required, VDB Entry
- https://vuldb.com/?id.351210 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.771759 Exploit, Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/ Product