CVE-2026-11493
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.
Risk Assessment
The organization may face unauthorized access to network resources by local attackers who could exploit weak passwords to compromise Samba services.
Recommendation
Recommend changing the Samba configuration on the Tenda AC15 router to enforce stronger password requirements and monitor the local network for unauthorized access attempts.
Other vulnerabilities in Tenda AC15
See all- CVE-2026-5830High
In Tenda AC15 version 15.03.05.18, the function websGetVar in /goform/SysToolChangePwd is vulnerable to stack-based buffer overflow via manipulation of arguments oldPwd/newPwd/cfmPwd. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-55564High
A stack overflow vulnerability exists in the Tenda AC15 router firmware version 15.03.05.19_multi_TD01 in the fromSetIpMacBind function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Original NVD description (English source)
A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.