Vulnerabilities & Exploits · Web App Attack
Tenda PoCs exploit default-state router trust CSIRT Italia said public proof-of-concept code is now available for three critical Tenda flaws in the AC1206 and AC18 routers, including CVE-2026-82693 , CVE-2026-82694 , and CVE-2026-82695 . The issue hits devices whose web-admin password has never been set.
In that factory-default state, the web UI trusts special management paths without authentication. An attacker can turn on Telnet or trigger admin actions such as reboot, factory reset, and configuration changes, so the box is exposed before anyone has “hardened” it in the usual sense.
For operators, the exposure is not just a router bug but a setup-state problem: any unit still sitting at an uninitialized admin screen may already be reachable as a remote management foothold. That makes deployed default-config devices the part of the fleet that now carries the risk.
1 source · Sep 1
CVE-2026-82693 NVD KEV
CVSS 10 CRITICAL: a vulnerability was determined in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).
CVE-2026-82694 NVD KEV
CVSS 10 CRITICAL: a vulnerability was identified in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).
CVE-2026-82695 NVD KEV
CVSS 10 CRITICAL: a security flaw has been discovered in Tenda AC18 15.03.05.19. EPSS 1% (71st percentile).
Timeline Sources Sep 1 CSIRT Italia / ACN
Tenda: PoC pubblici per 3 nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di 3 nuove vulnerabilità con gravità "critica", che interessano i router Tenda AC1206 e AC18.
original Part of the PlainSec briefing for 2026-09-01
Every edition of this story: Tenda PoCs exploit default-state router trust
More from today Vulnerabilities & Exploits · Web App Attack
Tenda PoCs exploit default-state router trust CSIRT Italia said public proof-of-concept code is now available for three critical Tenda flaws in the AC1206 and AC18 routers, including CVE-2026-82693 , CVE-2026-82694 , and CVE-2026-82695 . The issue hits devices whose web-admin password has never been set.
In that factory-default state, the web UI trusts special management paths without authentication. An attacker can turn on Telnet or trigger admin actions such as reboot, factory reset, and configuration changes, so the box is exposed before anyone has “hardened” it in the usual sense.
For operators, the exposure is not just a router bug but a setup-state problem: any unit still sitting at an uninitialized admin screen may already be reachable as a remote management foothold. That makes deployed default-config devices the part of the fleet that now carries the risk.
1 source · Sep 1
CVE-2026-82693 NVD KEV
CVSS 10 CRITICAL: a vulnerability was determined in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).
CVE-2026-82694 NVD KEV
CVSS 10 CRITICAL: a vulnerability was identified in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).
CVE-2026-82695 NVD KEV
CVSS 10 CRITICAL: a security flaw has been discovered in Tenda AC18 15.03.05.19. EPSS 1% (71st percentile).
Timeline Sources Sep 1 CSIRT Italia / ACN
Tenda: PoC pubblici per 3 nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di 3 nuove vulnerabilità con gravità "critica", che interessano i router Tenda AC1206 e AC18.
original Part of the PlainSec briefing for 2026-09-01
Every edition of this story: Tenda PoCs exploit default-state router trust
More from today