CVE-2026-115797
Tenda F6 Web Management cleartext transmission
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
3.7
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0 (listed by NVD)
2.9
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
6.3
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
0.3%
Percentile 22.3%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interactionConditions
PoC
Confidentiality LIntegrity NAvailability N
This vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | H | High (conditions required) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | L | Low |
| Integrity I | N | None |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
NVD
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 2.9 LOW | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 3.7 LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD / [email protected] (Secondary) | 2.0 | 2.6 LOW | AV:N/AC:H/Au:N/C:P/I:N/A:N |
| CNA / VulDB | 4.0 | 6.3 MEDIUM | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 3.7 LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| CNA / VulDB | 3.0 | 3.7 LOW | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| CNA / VulDB | 2.0 | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Tenda | F6 | affected: 12.02.01.73 |
Linux distribution status
References (6)
- https://github.com/0xWKZER/tenda-f6-vulnerabilities/edit/main/02-Cleartext_Transmission.md NVD, CNA exploit
- https://vuldb.com/cve/CVE-2026-115797 NVD, CNA third-party-advisory
- https://vuldb.com/submit/1022076 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/425975 NVD, CNA vdb-entrytechnical-description
- https://vuldb.com/vuln/425975/cti NVD, CNA signaturepermissions-required
- https://www.tenda.com.cn/ NVD, CNA product