F6
Monthly
Cleartext transmission of the sensitive ecos_pw value in the Tenda F6 router (firmware 12.02.01.73) web management interface exposes that value to anyone positioned on the network path between the management client and the device. The flaw is rated low severity (CVSS 4.0 score 2.9; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because confidentiality impact is limited and exploitation requires the attacker to already be able to observe the traffic, which the vendor describes as difficult. Only a public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation or fixed firmware version is documented in the available sources.
Cross-site request forgery (CWE-352) in the Tenda F6 web management interface (firmware 12.02.01.73) lets an attacker who controls a web page cause a logged-in administrator's browser to submit forged, session-authenticated requests against the router. The attacker needs no credentials (PR:N) but gains nothing without an active admin session to ride, and the victim must be induced to visit the malicious page (UI:P), so impact is bounded to limited integrity per the assessed vector (VI:L, no confidentiality or availability effect). A public PoC reference exists on GitHub (0xWKZER/tenda-f6-vulnerabilities); it is not verified as working exploit code, the issue is not in CISA KEV, and the vuln.today priority label places it in the this_month remediation window rather than an emergency.
Cleartext transmission of the sensitive ecos_pw value in the Tenda F6 router (firmware 12.02.01.73) web management interface exposes that value to anyone positioned on the network path between the management client and the device. The flaw is rated low severity (CVSS 4.0 score 2.9; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because confidentiality impact is limited and exploitation requires the attacker to already be able to observe the traffic, which the vendor describes as difficult. Only a public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation or fixed firmware version is documented in the available sources.
Cross-site request forgery (CWE-352) in the Tenda F6 web management interface (firmware 12.02.01.73) lets an attacker who controls a web page cause a logged-in administrator's browser to submit forged, session-authenticated requests against the router. The attacker needs no credentials (PR:N) but gains nothing without an active admin session to ride, and the victim must be induced to visit the malicious page (UI:P), so impact is bounded to limited integrity per the assessed vector (VI:L, no confidentiality or availability effect). A public PoC reference exists on GitHub (0xWKZER/tenda-f6-vulnerabilities); it is not verified as working exploit code, the issue is not in CISA KEV, and the vuln.today priority label places it in the this_month remediation window rather than an emergency.