CVE-2026-82693

CVE-2026-82693 is a missing-authentication flaw (CWE-306/CWE-287) in the TendaTelnet function of the file /goform/telnet, part of the Web UI of the Tenda AC1206 router running firmware 15.03.06.23. An unauthenticated remote attacker can trigger the flaw by sending a manipulated request to this endpoint, which bypasses authentication on the Telnet component. With a CVSS 4.0 base score of 9.3 and high ratings for confidentiality, integrity, and availability (including on subsequent systems), an attacker who reaches this endpoint could gain substantial, potentially full, control of the device, though the advisory does not detail the exact post-access capabilities. Operators of Tenda AC1206 routers on the affected firmware are exposed, particularly devices whose Web UI is reachable from the internet or untrusted networks. Per the advisory the exploit has been publicly disclosed and may be used; the flaw is not yet in CISA KEV, no standalone PoC is catalogued in the data, and EPSS currently estimates a 0.8% probability of exploitation within 30 days.

What to do: Check Tenda's support/download site for firmware newer than 15.03.06.23 and upgrade as soon as a fixed build is released, since the advisory specifies no fixed version. Until then, disable the Telnet service or restrict access to /goform/telnet, keep the router's Web UI off the WAN (limit management to the trusted LAN or VPN), and block Telnet (TCP/23) from untrusted networks. Review device logs for unexpected requests to /goform/telnet or unexpected Telnet sessions as a sign of probing or compromise.