CVE-2026-82694
CriticalCVSS 10.0Summary
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
An unauthenticated attacker may access security functions without authentication, potentially allowing modification of security settings.
Recommendation
Update the router firmware to the latest version if available. Restrict access to the administrative panel from trusted networks.
Other vulnerabilities in Tenda AC1206
See all- CVE-2026-82693Critical
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-19789High
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. The function set_wl_guest_iplist in /goform/WifiGuestSet of the httpd web management interface is affected. Manipulating the argument shareSpeed causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-19788High
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. The function set_device_name in /goform/SetOnlineDevName of the httpd web management interface is affected. Manipulating the argument devName results in stack-based buffer overflow. The attack may be launched remotely, and the exploit has been made public.
- CVE-2026-36789High
In the Tenda AC1206 router with firmware version v15.03.06.23, multiple stack overflows exist in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Original NVD description (English source)
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.