CVE-2026-4252 - Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

Back Back to CVE browser

CRITICAL

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

Published Mar 16, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 1.98%

Description

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Affected products

Vendor Tenda Product AC8 Default
n/a
- Version
  16.03.50.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tenda

AC8

n/a

Version	Status	Constraints
16.03.50.11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-291

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12470
Advisory
https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py
exploit
https://vuldb.com/?ctiid.351210
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.351210
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.771759
third-party-advisoryExploitThird Party AdvisoryVDB Entry
https://www.tenda.com.cn/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12470		Advisory
https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py		exploit
https://vuldb.com/?ctiid.351210		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.351210		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.771759		third-party-advisoryExploitThird Party AdvisoryVDB Entry
https://www.tenda.com.cn/		product