CVE-2026-4252

CRITICAL

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

Title source: cna

Description

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

References (5)

[Product] https://www.tenda.com.cn/

[Vdb Entry, Technical Description] https://vuldb.com/?id.351210

[Signature, Permissions Required] https://vuldb.com/?ctiid.351210

[Third Party Advisory] https://vuldb.com/?submit.771759

[Exploit] https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0037

EPSS Percentile 58.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287 CWE-291

Status published

Products (2)

Tenda/AC8 16.03.50.11

tenda/ac8_firmware 16.03.50.11

Published Mar 16, 2026

Tracked Since Mar 16, 2026