CVE-2026-4252CWE-287CWE-291

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

Critical · published March 16, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01260 · 67.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-291 · Reliance on IP Address for Authentication
Published
2026-03-16T16:32Z
EPSS history
Timeline
  • 16 MAR 16:32Z
    Tenda AC8 IPv6 check_is_ipv6 ip address for authentication
    cvelistv5