EUVD-2026-72351
GHSA-j3cm-vx4c-h779
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Tenda AC9 web management port
-
DeliverySend unauthenticated HTTP request to protected endpoint
-
ExploitR7WebsSecurityHandler skips authentication check
-
ExecutionRead device/product info or overwrite WiFi credentials
-
PersistConnect to network with attacker-controlled PSK
-
ImpactFull LAN access to network clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration or authentication is required - exploitation targets the default web management interface of any Tenda AC9 device running firmware 15.03.05.14 that has its HTTP management port reachable from the attacker's network. Exploitation is limited by network reachability: if the management interface is bound only to the LAN interface and WAN-side management is disabled (a common default), the attacker must be on the local network. If WAN-side management is enabled, the attack is fully remote from the internet. No user interaction, no credentials, and no non-default configuration are required beyond network access to the management port. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) rates the base score at 6.9, reflecting limited per-component impact. However, the practical risk is materially higher than the score suggests: unauthenticated WiFi password modification on a home or small-business router effectively grants an attacker full control over the local network, enabling client interception, traffic redirection, and lateral movement - impacts that fall outside the router's own CIA triad. The availability signal (VA:L) captures the disruption of router configuration but understates the downstream network impact. No CISA KEV listing exists, and EPSS data is not provided, but the public availability of working PoC code (E:P) substantially lowers the exploitation bar. With no vendor patch identified, the window of exposure is open-ended. The attack is fully network-accessible with no authentication, no special configuration, and no user interaction required, making automated scanning and mass exploitation technically feasible. |
| Exploit ScenarioDerived | An attacker performs an internet-wide scan for Tenda AC9 routers with exposed web management interfaces, then sends a crafted unauthenticated HTTP request directly to the fast_setting_wifi_set endpoint, bypassing R7WebsSecurityHandler's authentication check. The attacker overwrites the WiFi PSK with a value under their control, connects to the network, and achieves full LAN-level access to all connected devices. Working PoC code is publicly available and referenced in the CVE record. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).
RemediationAI
No vendor-released patch has been identified at time of analysis. As a primary compensating control, restrict access to the router's web management interface to trusted LAN hosts only and disable remote (WAN-side) management entirely if it is enabled. Placing the management interface behind a dedicated management VLAN or separate administrative network segment significantly reduces exposure. Where possible, implement firewall rules to block external access to the HTTP/HTTPS management ports (typically 80/443 or 8080). Administrators should also rotate WiFi credentials and monitor for unauthorized client associations, as exploitation of the fast_setting_wifi_set endpoint may have already occurred on exposed devices. Monitor VulDB entry https://vuldb.com/vuln/399464 and the Tenda vendor advisory page https://www.tenda.com.cn/ for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda AC9 is a SOHO wireless router; the affected firmware version is 15.03.05.14. The vulnerability resides in the R7WebsSecurityHandler function within the web management component, which is responsible for enforcing authentication on protected HTTP endpoints. CWE-287 (Improper Authentication) indicates the handler fails to correctly validate authentication state or session tokens before granting access to sensitive operations. CPE cpe:2.3:a:tenda:ac9:*:*:*:*:*:*:*:* covers all tracked versions. The PoC references two distinct vulnerable endpoints: a read-only product info disclosure path and a write path permitting WiFi password changes without credentials, consistent with a broadly failing authentication gate rather than a single endpoint flaw.
Know when Ac9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible, no auth, no interaction required; C:L and I:L reflect limited info disclosure and WiFi config write; no direct availability impact on the router.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 enables authenticated remote attackers to execute a
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 allows authenticated remote attackers to execute ar
Exploit-DB