CVE-2026-4252

CRITICAL

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

Title source: cna

Description

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

References (5)

Core 5

Core References

Product product

https://www.tenda.com.cn/

Vdb Entry, Technical Description vdb-entry technical-description

VDB-351210 | Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

https://vuldb.com/?id.351210

Signature, Permissions Required signature permissions-required

VDB-351210 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/?ctiid.351210

Third Party Advisory third-party-advisory

Submit #771759 | Tenda AC8 V5 V16.03.50.11 Authentication Bypass Issues

https://vuldb.com/?submit.771759

Exploit exploit

https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0126

EPSS Percentile 65.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287 CWE-291

Status published

Products (2)

Tenda/AC8 16.03.50.11

tenda/ac8_firmware 16.03.50.11

Published Mar 16, 2026

Tracked Since Mar 16, 2026