Tenda AC1206 CVE-2026-82694

No credentials or user interaction are required - R7WebsSecurityHandler omits the authentication check on the /goform/ate endpoint, so any request reaching that path on Tenda AC1206 firmware 15.03.06.23 is processed as if authorized. The concrete prerequisite is network reachability to the device's HTTP web-UI service. The key limiting factor is exposure: SOHO router admin interfaces are typically LAN-bound, so practical exploitation generally requires an attacker on the local/Wi-Fi network unless WAN-side remote management is enabled, in which case it becomes internet-reachable. Confirmed affected build is 15.03.06.23; behavior on other firmware versions is unverified.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact) describes an easy, unauthenticated, network-reachable bug, and publicly available exploit code raises practical risk. However, several tempering signals apply: this is a VulDB-sourced disclosure for a consumer router, there is no CISA KEV listing (no confirmed active exploitation) and no EPSS probability was supplied, so evidence of real-world mass exploitation is currently absent. The most important real-world limiter is exposure surface - SOHO router web UIs are normally bound to the LAN, so 'remote' realistically means same-network (or WAN-exposed only where remote management is enabled), which meaningfully narrows the attack population versus an internet-facing service. The subsequent-system impact metrics (SC/SI/SA:H) in the supplied 4.0 vector look optimistic for a self-contained device compromise and should be treated with caution. Net assessment: a genuinely serious, easy-to-exploit flaw for anyone able to reach the device's web interface, warranting prompt patching where these routers are deployed, but not clearly a widespread internet-wide emergency absent KEV/EPSS corroboration.

An attacker with reachability to the router's web interface (a malicious client on the LAN/Wi-Fi, or the internet if remote management is enabled) sends a crafted HTTP request directly to /goform/ate, which R7WebsSecurityHandler serves without checking authentication. Because public exploit code exists and attack complexity is low, the attacker invokes the exposed factory/diagnostic functionality to reconfigure or take control of the device with no credentials. This requires no user interaction and no prior authentication.