CVE-2026-86300
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
Risk Assessment
The risk is the possibility of remotely bypassing authentication, potentially allowing unauthorized access to the device's management panel and its configuration.
Recommendation
It is recommended to immediately update Tenda AC9 firmware to the latest version that fixes this issue, and restrict access to the management panel only from trusted networks.
Other vulnerabilities in Tenda AC9
See all- CVE-2022-36233Medium
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.
- CVE-2021-31627High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
- CVE-2021-31624High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
Original NVD description (English source)
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS