Security readout for executives and security teams
Plain-English summary
A remotely reachable flaw in the Tenda AC1206 web interface may let an unauthenticated attacker access a telnet-related administrative function. Successful abuse could severely compromise the router and connected network. The supplied evidence identifies firmware 15.03.06.23 only.
Executive priority
Treat as an immediate remediation priority where vulnerable management interfaces are internet-accessible or broadly reachable internally. Inventory affected routers, contain management exposure, and seek confirmed vendor remediation. Do not interpret the absence of KEV status as evidence of safety.
Technical view
CVE-2026-82693 affects the TendaTelnet function at /goform/telnet in Tenda AC1206 firmware 15.03.06.23. Missing authentication or authorization permits remote, unauthenticated interaction. The CVSS 4.0 score is 10.0, with high confidentiality, integrity, and availability impacts across vulnerable and subsequent systems.
Likely exposure
Highest risk applies to AC1206 devices running firmware 15.03.06.23 whose web management interface is reachable from untrusted networks. Internal-only interfaces remain exposed to attackers already on the local network. The bundle does not establish that other firmware versions or Tenda products are affected.
Exploitation context
A public technical disclosure or exploit is referenced, so practical exploitation information may be available. However, the bundle reports no CISA KEV listing and provides no evidence of active exploitation in the wild. Public disclosure increases urgency without proving current attacks.
Researcher notes
The evidence attributes CWE-287 and CWE-306 and identifies one firmware release. It does not provide a vendor-confirmed patch, detection signature, observed campaign, or proof of exploitation in the wild. Avoid extrapolating impact to other versions or products until supported by vendor or CVE updates.
Mitigation direction
- Identify and prioritize every Tenda AC1206 running firmware 15.03.06.23.
- Block web management access from the internet and other untrusted networks.
- Restrict device administration to trusted management hosts or a dedicated management network.
- Disable remote administration and telnet-related functionality where safely supported.
- Check Tenda guidance for confirmed fixed firmware or vendor-approved mitigation.
- Replace or isolate affected devices if no supported remediation is available.
Validation and detection
- Confirm device model and firmware using inventory data or authenticated administration records.
- Review firewall and NAT rules for externally reachable management interfaces.
- Check device and perimeter logs for unexpected requests to /goform/telnet.
- Verify compensating controls prevent untrusted hosts from reaching web management.
- Confirm any installed firmware is explicitly identified by Tenda as resolving this CVE.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-82693 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDBCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.96VulDBCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.96VulDBAV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR1010VulDBVulnerability scoring details
Base CVSS 4.0 score
10CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
10CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
10CriticalVector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-397181 | Tenda AC1206 Web UI telnet TendaTelnet missing authenticationCVE reference, VulDB · vdb-entry, technical-description
- VDB-397181 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-82693 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #894235 | Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Missing AuthorizatiCVE reference, VulDB · third-party-advisory
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001-vulndb.mdCVE reference, VulDB · exploit
- https://www.tenda.com.cn/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.