Vulnerabilities · 57 days ago

Tenda PoCs exploit default-state router trust

CSIRT Italia said public proof-of-concept code is now available for three critical Tenda flaws in the AC1206 and AC18 routers, including CVE-2026-82693, CVE-2026-82694, and CVE-2026-82695. The issue hits devices whose web-admin password has never been set.

In that factory-default state, the web UI trusts special management paths without authentication. An attacker can turn on Telnet or trigger admin actions such as reboot, factory reset, and configuration changes, so the box is exposed before anyone has “hardened” it in the usual sense.

For operators, the exposure is not just a router bug but a setup-state problem: any unit still sitting at an uninitialized admin screen may already be reachable as a remote management foothold. That makes deployed default-config devices the part of the fleet that now carries the risk.

CVE-2026-82693

NVD KEV

CVSS 10 CRITICAL: a vulnerability was determined in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).

CVE-2026-82694

NVD KEV

CVSS 10 CRITICAL: a vulnerability was identified in Tenda AC1206 15.03.06.23. EPSS 1% (72nd percentile).

CVE-2026-82695

NVD KEV

CVSS 10 CRITICAL: a security flaw has been discovered in Tenda AC18 15.03.05.19. EPSS 1% (71st percentile).

Timeline

Sep 1 Reported by CSIRT Italia / ACN

Sources

1 source covering this story

CSIRT Italia / ACN Sep 1
Tenda: PoC pubblici per 3 nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di 3 nuove vulnerabilità con gravità "critica", che interessano i router Tenda AC1206 e AC18.

Entities

CVE-2026-82693
CVE-2026-82694
CVE-2026-82695

Part of the PlainSec briefing for 2026-09-01

Editions

Briefing for 2026-09-01

Vulnerabilities · 57 days agoTenda PoCs exploit default-state router trustCSIRT Italia said public proof-of-concept code is now available for three critical Tenda flaws in the AC1206 and AC18 routers, including CVE-2026-82693, CVE-2026-82694, and CVE-2026-82695. The issue hits devices whose web-admin password has never been set.In that factory-default state, the web UI trusts special management paths without authentication. An attacker can turn on Telnet or trigger admin actions such as reboot, factory reset, and configuration changes, so the box is exposed before anyone has “hardened” it in the usual sense.For operators, the exposure is not just a router bug but a setup-state problem: any unit still sitting at an uninitialized admin screen may already be reachable as a remote management foothold. That makes deployed default-config devices the part of the fleet that now carries the risk.