CVE-2026-115796 in Tenda
Summary
by MITRE • 10/23/2026
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Tenda F6 router, specifically version 12.02.01.73 of its firmware, contains a critical security vulnerability within its Web Management Interface that allows for cross-site request forgery attacks. This flaw resides in an unspecified function responsible for handling administrative requests through the web-based configuration portal. The presence of this vulnerability indicates a failure to implement adequate anti-CSRF mechanisms, such as unique per-session tokens or strict origin validation headers, which are standard requirements for securing state-changing HTTP operations against unauthorized initiation by malicious third-party sites.
Cross-site request forgery is classified under CWE-352 in the Common Weakness Enumeration framework and corresponds to T1496 Resource Hijacking within the MITRE ATT&CK enterprise matrix when leveraged to compromise device settings or redirect traffic. In this specific context, an attacker can craft a malicious webpage that contains hidden requests targeting the router's administrative endpoints. When a victim with active authentication sessions for the Tenda F6 web interface visits this malicious page, their browser will automatically include valid session cookies and credentials in the forged request due to standard HTTP cookie behavior. This allows the attacker to execute arbitrary commands on behalf of the authenticated user without their knowledge or consent.
The operational impact of this vulnerability is severe because it enables remote attackers to manipulate router configurations from any location with internet access, provided they can lure a victim into accessing a controlled webpage while logged into the router's admin panel. Successful exploitation could lead to unauthorized changes in DNS settings, firewall rules, port forwarding configurations, or administrative credentials. Such modifications can facilitate broader network attacks including man-in-the-middle interceptions, redirection of traffic to malicious servers for phishing or malware distribution, and complete compromise of the local area network protected by the device. The fact that an exploit has been publicly released significantly lowers the barrier to entry for threat actors, increasing the likelihood of automated scanning and opportunistic attacks against vulnerable devices in residential and small business environments.
Mitigation strategies must focus on both immediate remediation and long-term security hygiene. Users should immediately update their Tenda F6 firmware to a version where this vulnerability has been patched by the vendor, ensuring that proper CSRF token validation is enforced for all administrative actions. If an updated firmware is unavailable or cannot be applied promptly, administrators can mitigate risk by disabling remote management features if they are not strictly necessary, thereby reducing the attack surface accessible from external networks. Additionally, users should avoid logging into router administration pages while browsing untrusted websites and consider using separate browser profiles or containers for administrative tasks to isolate session cookies from general web activity. Regularly changing strong administrator passwords and monitoring network logs for unusual configuration changes can also help detect potential exploitation attempts early.