by Kastro
Paper/Archive/CVE-2026-4252

CVE-2026-4252

Tenda AC8 — Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.1.701 × 2014.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Affected

ProductAffectedFixed inSource
AC816.03.50.11–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.351210refvuldb.com/?ctiid.351210writeupvuldb.com/?submit.771759exploitgithub.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.pyreftenda.com.cn