EUVD-2026-68507
GHSA-79rc-8x3p-4wjw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable endpoint with no auth check gives PR:N/UI:N/AC:L; full device control yields C/I/A:H; impact confined to the device so S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
AnalysisAI
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No credentials or user interaction are required - R7WebsSecurityHandler omits the authentication check on the /goform/ate endpoint, so any request reaching that path on Tenda AC1206 firmware 15.03.06.23 is processed as if authorized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact) describes an easy, unauthenticated, network-reachable bug, and publicly available exploit code raises practical risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version is identified at time of analysis, and no fixed build is cited in the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit your network for Tenda AC1206 devices and verify firmware version (affected: 15.03.06.23); check device logs and firewall logs for suspicious access to the /goform/ate endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interfac
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today