CVE-2026-86300

5.5 mediumEPSS 0.8%

Medium (5.5). EPSS 0.8% chance of exploitation in the next 30 days.

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2026-09-07
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/limou89/somevul/blob/main/Tenda_AC9_fast_setting_wifi_set_Unauth_Password.md
https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md
https://vuldb.com/cve/CVE-2026-86300
https://vuldb.com/submit/906606
https://vuldb.com/submit/906607

Check your stack JSON