Vulnerability · Published Mar 16, 2026 · Assigned by VulDB
CVE-2026-4252Tenda AC8 IPv6 check_is_ipv6 ip address for authentication
Critical 9.8
In plain English
A critical-severity improper authentication in AC8 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.3%top 29.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Affected products (as reported)
Weakness: CWE-291, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R
References
- VDB-351210 | Tenda AC8 IPv6 check_is_ipv6 ip address for authentication vdb-entry, technical-description
- VDB-351210 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #771759 | Tenda AC8 V5 V16.03.50.11 Authentication Bypass Issues third-party-advisory
- https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py exploit
- https://www.tenda.com.cn/ product