Search
Find a vulnerability
Search criteria
4 vulnerabilities found for F6 by Tenda
CVE-2026-115797 (GCVE-0-2026-115797)
Vulnerability from nvd – Published: 2026-10-23 20:00 – Updated: 2026-10-23 20:00
VLAI
EPSS
VEX
Title
Tenda F6 Web Management cleartext transmission
Summary
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425975 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/425975/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115797 | third-party-advisory |
| https://vuldb.com/submit/1022076 | third-party-advisory |
| https://github.com/0xWKZER/tenda-f6-vulnerabiliti… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:f6:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "F6",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "12.02.01.73"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "WKZER (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "WKZER (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:00:16.370Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425975 | Tenda F6 Web Management cleartext transmission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/425975"
},
{
"name": "VDB-425975 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425975/cti"
},
{
"name": "CVE-2026-115797 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115797"
},
{
"name": "Submit #1022076 | Tenda F6 (N300) Wireless Router Firmware V12.02.01.73 (Hardware V5.0) Cleartext Transmission of Sensitive Information (CWE-319)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022076"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xWKZER/tenda-f6-vulnerabilities/edit/main/02-Cleartext_Transmission.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T18:17:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda F6 Web Management cleartext transmission",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115797",
"datePublished": "2026-10-23T20:00:16.370Z",
"dateReserved": "2026-10-23T14:57:47.218Z",
"dateUpdated": "2026-10-23T20:00:16.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115796 (GCVE-0-2026-115796)
Vulnerability from nvd – Published: 2026-10-23 19:45 – Updated: 2026-10-23 19:45
VLAI
EPSS
VEX
Title
Tenda F6 Web Management cross-site request forgery
Summary
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425974 | vdb-entry |
| https://vuldb.com/vuln/425974/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115796 | third-party-advisory |
| https://vuldb.com/submit/1022074 | third-party-advisory |
| https://github.com/0xWKZER/tenda-f6-vulnerabiliti… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:f6:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "F6",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "12.02.01.73"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "WKZER (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "WKZER (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T19:45:19.860Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425974 | Tenda F6 Web Management cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/425974"
},
{
"name": "VDB-425974 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425974/cti"
},
{
"name": "CVE-2026-115796 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115796"
},
{
"name": "Submit #1022074 | Tenda F6 (N300) Wireless Router Firmware V12.02.01.73 (Hardware V5.0) Cross-Site Request Forgery (CWE-352)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022074"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T18:17:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda F6 Web Management cross-site request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115796",
"datePublished": "2026-10-23T19:45:19.860Z",
"dateReserved": "2026-10-23T14:57:43.016Z",
"dateUpdated": "2026-10-23T19:45:19.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115797 (GCVE-0-2026-115797)
Vulnerability from cvelistv5 – Published: 2026-10-23 20:00 – Updated: 2026-10-23 20:00
VLAI
EPSS
VEX
Title
Tenda F6 Web Management cleartext transmission
Summary
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425975 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/425975/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115797 | third-party-advisory |
| https://vuldb.com/submit/1022076 | third-party-advisory |
| https://github.com/0xWKZER/tenda-f6-vulnerabiliti… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:f6:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "F6",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "12.02.01.73"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "WKZER (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "WKZER (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:00:16.370Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425975 | Tenda F6 Web Management cleartext transmission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/425975"
},
{
"name": "VDB-425975 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425975/cti"
},
{
"name": "CVE-2026-115797 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115797"
},
{
"name": "Submit #1022076 | Tenda F6 (N300) Wireless Router Firmware V12.02.01.73 (Hardware V5.0) Cleartext Transmission of Sensitive Information (CWE-319)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022076"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xWKZER/tenda-f6-vulnerabilities/edit/main/02-Cleartext_Transmission.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T18:17:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda F6 Web Management cleartext transmission",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115797",
"datePublished": "2026-10-23T20:00:16.370Z",
"dateReserved": "2026-10-23T14:57:47.218Z",
"dateUpdated": "2026-10-23T20:00:16.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115796 (GCVE-0-2026-115796)
Vulnerability from cvelistv5 – Published: 2026-10-23 19:45 – Updated: 2026-10-23 19:45
VLAI
EPSS
VEX
Title
Tenda F6 Web Management cross-site request forgery
Summary
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425974 | vdb-entry |
| https://vuldb.com/vuln/425974/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115796 | third-party-advisory |
| https://vuldb.com/submit/1022074 | third-party-advisory |
| https://github.com/0xWKZER/tenda-f6-vulnerabiliti… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:f6:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "F6",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "12.02.01.73"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "WKZER (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "WKZER (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T19:45:19.860Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425974 | Tenda F6 Web Management cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/425974"
},
{
"name": "VDB-425974 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425974/cti"
},
{
"name": "CVE-2026-115796 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115796"
},
{
"name": "Submit #1022074 | Tenda F6 (N300) Wireless Router Firmware V12.02.01.73 (Hardware V5.0) Cross-Site Request Forgery (CWE-352)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022074"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T18:17:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda F6 Web Management cross-site request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115796",
"datePublished": "2026-10-23T19:45:19.860Z",
"dateReserved": "2026-10-23T14:57:43.016Z",
"dateUpdated": "2026-10-23T19:45:19.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}