CVE-2026-4252

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4252", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-16T06:16:02.051Z", "datePublished": "2026-03-16T16:32:10.508Z", "dateUpdated": "2026-03-16T18:07:41.022Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T16:32:10.508Z"}, "title": "Tenda AC8 IPv6 check_is_ipv6 ip address for authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-291", "lang": "en", "description": "Reliance on IP Address for Authentication"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "Tenda", "product": "AC8", "versions": [{"version": "16.03.50.11", "status": "affected"}], "cpes": ["cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*"], "modules": ["IPv6 Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR"}}], "timeline": [{"time": "2026-03-16T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-16T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-16T07:21:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "DigitalAndrew (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.351210", "name": "VDB-351210 | Tenda AC8 IPv6 check_is_ipv6 ip address for authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351210", "name": "VDB-351210 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771759", "name": "Submit #771759 | Tenda AC8 V5 V16.03.50.11 Authentication Bypass Issues", "tags": ["third-party-advisory"]}, {"url": "https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py", "tags": ["exploit"]}, {"url": "https://www.tenda.com.cn/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T18:07:31.177772Z", "id": "CVE-2026-4252", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:07:41.022Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4252", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T18:07:31.177772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:07:36.228Z"}}], "cna": {"title": "Tenda AC8 IPv6 check_is_ipv6 ip address for authentication", "credits": [{"lang": "en", "type": "reporter", "value": "DigitalAndrew (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["IPv6 Handler"], "product": "AC8", "versions": [{"status": "affected", "version": "16.03.50.11"}]}], "timeline": [{"lang": "en", "time": "2026-03-16T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-16T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-16T07:21:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351210", "name": "VDB-351210 | Tenda AC8 IPv6 check_is_ipv6 ip address for authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351210", "name": "VDB-351210 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771759", "name": "Submit #771759 | Tenda AC8 V5 V16.03.50.11 Authentication Bypass Issues", "tags": ["third-party-advisory"]}, {"url": "https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py", "tags": ["exploit"]}, {"url": "https://www.tenda.com.cn/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-291", "description": "Reliance on IP Address for Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T16:32:10.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4252", "state": "PUBLISHED", "dateUpdated": "2026-03-16T18:07:41.022Z", "dateReserved": "2026-03-16T06:16:02.051Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T16:32:10.508Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*"], "modules": ["IPv6 Handler"], "product": "AC8", "vendor": "Tenda", "versions": [{"status": "affected", "version": "16.03.50.11"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac8_firmware:16.03.50.11:*:*:*:*:*:*:*", "matchCriteriaId": "3744DBBC-5138-4CCE-8C19-9F807AE34304", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac8:-:*:*:*:*:*:*:*", "matchCriteriaId": "C81F1E48-0204-4478-A937-5D40CDD9E5E4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en Tenda AC8 16.03.50.11. Afectada por este problema es la funci\u00f3n check_is_ipv6 del componente Gestor IPv6. La manipulaci\u00f3n conduce a la dependencia de la direcci\u00f3n IP para la autenticaci\u00f3n. Es posible iniciar el ataque remotamente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado."}], "id": "CVE-2026-4252", "lastModified": "2026-06-17T10:56:18.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4252", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T18:07:31.177772Z", "version": "2.0.3"}}]}, "published": "2026-03-16T17:16:32.057", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.351210"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.351210"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.771759"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://www.tenda.com.cn/"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-291"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.03.50.11"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AC8", "source": "cna", "vendor": "Tenda"}, "product": "ac8", "vendor": "tenda"}], "analysis": {"en": {"generated_at": "2026-04-03T22:54:56.058019+00:00", "value": {"mitigation_remediation": ["Update the router\u2019s firmware to a version that addresses the IPv6 authentication bypass, downloading the latest release from Tenda\u2019s official website.", "After installing the update, reboot the device and verify that login no longer accepts IP\u2011based authentication shortcuts.", "If a firmware update is unavailable, disable IPv6 on the router or block IPv6 traffic to the router\u2019s management interface through your network firewall, thereby limiting the attack vector.", "Monitor management interface logs for suspicious login attempts and review audit trails after mitigation."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Devices affected by this defect are Tenda AC8 routers running firmware version 16.03.50.11. The CPE entries indicate that the firmware product and the hardware model are susceptible. No other product versions or vendors are listed, so only current AC8 devices with the specified firmware are at risk.", "description_and_impact": "The vulnerability originates from the check_is_ipv6 function in the IPv6 Handler of the Tenda AC8 firmware. The implementation improperly relies on the client\u2019s IPv6 address to satisfy authentication conditions, allowing an attacker to bypass normal credential checks. Consequently, an attacker who successfully bypasses authentication could gain administrative access to the router\u2019s web interface, potentially compromising the confidentiality, integrity, and availability of the network. The weakness corresponds to authentication bypass (CWE\u2011287) and improper authorization (CWE\u2011291).", "risk_and_exploitability": "The assigned CVSS score of 9.3 denotes critical severity. The EPSS score is below 1% , implying that large\u2011scale exploitation is unlikely at present, yet a publicly available proof\u2011of\u2011concept on GitHub demonstrates that the exploit is reachable. Based on the description, the exploit can be launched remotely through the router\u2019s management interface; it does not require physical access. As the flaw is not listed in the CISA KEV catalog, no mass\u2011distribution is recorded, but the risk remains high because successful authentication bypass directly grants privileged control over the device."}}}}, "created": "2026-03-17T09:52:34.305748+00:00", "updated": "2026-04-07T08:09:05.485720+00:00", "vendors": ["tenda", "tenda$PRODUCT$ac8"]}