Tenda F6 CVE-2026-115796

Exploitation requires that an administrator already be authenticated to the Tenda F6 Web Management Interface AND be induced to perform a passive action - visiting an attacker-controlled web page (UI:P) - at which point the victim's browser submits a forged, session-authenticated request. The remote attacker needs no credentials of their own (PR:N), but has no independent access without an active admin session to ride; this session dependency and the required user interaction are the main limiting factors. The specific affected function, endpoint, and request parameters are not described in the available sources, so the exact configuration change achievable is unverified; impact is bounded to limited integrity (VI:L) with no confidentiality or availability effect per the vector.

This is a medium-severity cross-site request forgery flaw (CWE-352) in the Tenda F6 Web Management Interface, and the available signals point to a genuine but non-urgent issue rather than a widespread emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3) indicates a remotely reachable attack with low complexity and no attacker privileges, but with passive user interaction (UI:P) required and only limited integrity impact (VI:L) and no confidentiality or availability impact - consistent with a classic CSRF that abuses an already-authenticated administrator's session. The exploit maturity is E:P (proof-of-concept), matching a public PoC reference on GitHub, but that reference is NOT verified as working exploit code. CISA KEV is not indicated (no active exploitation), and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. The vendor.today Decision label is 'this_month', not 'act_now' or 'emergency', aligning with the picture of a real-but-moderate issue. Note the dependency gap: because PR:N describes the remote attacker while UI:P means a logged-in admin must be tricked into triggering the request, raw 'unauthenticated network' wording understates the practical precondition of an active admin session. Priority is moderate: patch on a normal cycle, not as a fire drill.

An attacker hosts or emails a malicious web page containing a hidden request targeting the Tenda F6 Web Management Interface. While an administrator is logged into the router's web console, they visit the attacker's page, and their browser silently submits the forged request using the admin's authenticated session, causing an unauthorized configuration change. A public PoC reference exists on GitHub (0xWKZER/tenda-f6-vulnerabilities), but it is not verified as working exploit code, and the specific affected function and parameters are not described in the available sources.