Tenda AC15 CVE-2026-11493

Exploitation requires the attacker to be positioned on the same adjacent network (LAN or WLAN) as the vulnerable Tenda AC15 - remote internet-based exploitation is not possible per AV:A. The Samba SMB file-sharing service must be enabled on the router (this may not be the default configuration for all deployments - verify via device admin panel). No authentication is required to initiate the attack (PR:N), and no victim user interaction is needed (UI:N). Exploitation is limited by high attack complexity (AC:H), which per CVSS 3.1 means the attacker cannot exploit at will and must engineer specific conditions or overcome non-trivial obstacles. The vulnerability is constrained to the /etc_ro/smb.conf Samba component specifically; other router services are not implicated. Network-layer access controls (firewall rules blocking SMB ports 445/139) would effectively prevent exploitation.

The CVSS 5.0 score reflects a bounded but real threat: AV:A limits exploitation to the local network segment, and AC:H signals that exploitation requires non-trivial conditions or precise targeting, reducing opportunistic risk significantly. PR:N and UI:N indicate no credentials or victim interaction are needed once the attacker is on the network. Impact is uniformly Low across CIA triad (C:L/I:L/A:L), confirming limited blast radius - likely restricted to Samba share access rather than full device compromise. The temporal modifier E:P confirms publicly available exploit code, elevating practical risk over baseline. The modifier RC:R (Reasonable confidence) means the vulnerability has not yet been independently confirmed by the vendor. Crucially, this CVE is not listed in the CISA KEV catalog, and the tags ('Brute Force', 'Information Disclosure') align with opportunistic SMB credential attacks rather than sophisticated campaigns. Real-world priority is moderate for environments where the Tenda AC15 Samba service is internet-reachable via bridging or VPN, but low in typical home deployments where LAN access is required.

An attacker physically present on the same local network segment as the Tenda AC15 router - such as a guest on a home or small-office Wi-Fi network - discovers the active Samba file-sharing service and leverages the weak password policy to brute-force SMB credentials using the publicly available proof-of-concept. With valid credentials obtained, the attacker accesses shared files on storage attached to the router, potentially exfiltrating sensitive documents or staging further lateral movement against other LAN-connected systems. The high attack complexity (AC:H) means the attacker may need specific timing, additional reconnaissance, or non-default conditions to succeed, making casual opportunistic exploitation unlikely.