Tenda F6 EUVD-2026-109146

The affected product is the Tenda F6 router firmware 12.02.01.73 Web Management Interface, and the specific prerequisite is that the ecos_pw argument is transmitted in cleartext, so an attacker must be able to observe or intercept that traffic - i.e. occupy an on-path position between the management client and the device. Exploitation is limited by high attack complexity (AC:H) and the vendor's own statement that exploitation is 'difficult': simply reaching the device over the network is not sufficient, the attacker must capture the cleartext transmission. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the impact is limited to confidentiality of the exposed value (VC:L); there is no integrity or availability impact. The available sources do not describe the exact function or trigger beyond the ecos_pw argument, and no fixed firmware version is provided.

This is a low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) yields a base score of only 2.9, driven by a single low confidentiality impact (VC:L) with no integrity or availability impact and an explicit high attack complexity (AC:H) - the vendor-echoed note that 'exploitability is told to be difficult' reinforces AC:H. The vuln.today Decision label is 'monitor', the lowest urgency tier, and this is consistent with the signals: no CISA KEV listing, no EPSS score provided, and only a PoC reference (not verified working exploit code). The one escalating signal - E:P (Proof-of-Concept) in the CVSS 4.0 temporal metric plus a public exploit reference on GitHub - is tempered by the fact that the reference is an unverified editable markdown page, not confirmed working code. No signals conflict here; they consistently point to a genuine but minor information-disclosure weakness in a consumer router, not an emergency. Note that for a CWE-319 cleartext-transmission flaw the PR:N rating means no credentials are needed, but realistic exploitation still requires the attacker to occupy an on-path/interception position, which is the practical reason for the AC:H and 'difficult' characterization.

An attacker positioned on the network path between a client and the Tenda F6 Web Management Interface observes the ecos_pw argument being transmitted in cleartext and captures the sensitive value. A public PoC reference exists on GitHub but is not verified as working exploit code, and the vendor itself characterizes exploitation as difficult (high complexity), so an on-path/interception foothold is the gating requirement.