Is there a public PoC exploit available for CVE-2026-11493?

Yes, a public proof-of-concept exploit is available for CVE-2026-11493. Prioritise patching immediately. EPSS: 0.1%.

Tenda AC15 CVE-2026-11493

Q: What is the CVSS score of CVE-2026-11493?

CVE-2026-11493 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35024 LOW

Weak Password Requirements (CWE-521)

2026-06-08 VulDB

GHSA-r2vf-hwwr-q9jg

Information Disclosure Brute Force Tenda Ac15

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 07:22 NVD

5.0 (MEDIUM) 1.3 (LOW)

Analysis Generated

Jun 08, 2026 - 06:52 vuln.today

DescriptionCVE.org

A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Weak password requirements in the Samba service of Tenda AC15 firmware 15.03.05.19 expose SMB file-sharing functionality to brute-force attacks from adjacent-network attackers. The flaw originates in the /etc_ro/smb.conf configuration, which enforces insufficient password complexity, enabling unauthenticated local-network adversaries to guess or brute-force credentials and achieve limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the high attack complexity (AC:H) and adjacency requirement (AV:A) constrain realistic exploitation to targeted, in-person or LAN-positioned threat actors.

Technical ContextAI

The affected component is the Samba SMB service on the Tenda AC15 consumer router, specifically the configuration file located at /etc_ro/smb.conf. Samba provides Windows-compatible file-sharing (SMB/CIFS protocol) on embedded Linux-based router firmware. CWE-521 (Weak Password Requirements) indicates the root cause is a policy-level failure: the smb.conf configuration does not enforce adequate password strength for Samba user accounts, potentially allowing null, trivial, or short passwords. The CPE string cpe:2.3:a:tenda:ac15:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the affected scope may extend beyond the single confirmed firmware version 15.03.05.19. This is a firmware-embedded misconfiguration rather than a memory-safety or injection flaw, which is consistent with the moderate CVSS score.

RemediationAI

No vendor-released patch has been identified at time of analysis for this vulnerability. The primary compensating control is to disable the Samba/SMB file-sharing feature entirely on the Tenda AC15 if it is not actively required - this eliminates the attack surface at the cost of losing LAN file-sharing capability. If Samba must remain active, manually enforce strong, unique passwords for all Samba user accounts on the device to mitigate brute-force risk; note that the underlying policy weakness in smb.conf may still permit weak passwords to be configured by other users. Additionally, restrict LAN segment access to the router's SMB port (TCP 445/139) using firewall rules or VLAN segmentation to limit which hosts can reach the service. Tenda's product page (https://www.tenda.com.cn/) should be monitored for firmware updates. The VulDB advisory at https://vuldb.com/vuln/369113 and the linked exploit Notion page (https://www.notion.so/Tenda-AC15-V15-03-05-19-3671f5ba98908023b508dc0330624dcd) may provide additional mitigation context.