---
id: "CVE-2026-115796"
kind: "vulnerability"
aliases: ["CVE-2026-115796"]
title: "Tenda F6 router: web management interface allows cross-site request forgery"
severity: "medium"
cvss: 5.0
epss: 0.0023
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "router", "self-hosted", "tenda", "tenda-f6"]
not_affected_if: ["different-firmware"]
published_at: "2026-10-23T20:17:21+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115796", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115796", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Tenda F6 router: web management interface allows cross-site request forgery

The web management interface of the Tenda F6 router (firmware 12.02.01.73) fails to protect against cross-site request forgery through an unknown function. A remote attacker who tricks a logged-in administrator into visiting a malicious page can make the device perform configuration changes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Log into the Tenda F6 web interface and note the firmware version shown in the status page; unknown whether the sources give a further check
- Confirm whether the admin interface is reachable from the internet by checking the WAN-side management settings; unknown whether the sources name a specific setting

## Fix

- unknown: the sources do not name a fixed firmware version or vendor patch
- Restrict management access to the local network and disable remote web management until a fix is confirmed

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115796
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115796

## From the sources

A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_