{"id":"CVE-2026-115797","kind":"vulnerability","aliases":["CVE-2026-115797"],"related":[],"title":"Tenda F6 router: web login sends password in cleartext","description":"A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.","summary":"The Tenda F6 web management interface, version 12.02.01.73, transmits the ecos_pw argument in cleartext. An attacker positioned to observe or manipulate traffic could capture the router admin password.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","router","self-hosted","tenda"],"not_affected_if":["other-firmware","web-interface-disabled"],"how_to_check":"- Check the firmware version under the router's status page and compare it to `12.02.01.73`\n- Confirm whether the web management interface is reachable from outside the local network","fix":"- unknown","status":"open","published_at":"2026-10-23T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:43:24+00:00","updated_at":"2026-10-25T04:43:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:43:24Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Tenda F6 router: web login sends password in cleartext","impact":"low","summary":"The Tenda F6 web management interface, version 12.02.01.73, transmits the ecos_pw argument in cleartext. An attacker positioned to observe or manipulate traffic could capture the router admin password.","category":"infrastructure","nicknames":[],"who_cares":["tenda","router","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Router admin password captured in cleartext by a traffic observer","analyst_note":"Confirm the fixed firmware version and whether a vendor advisory exists; the NVD entry gives no fix or check details.","how_to_check":"- Check the firmware version under the router's status page and compare it to `12.02.01.73`\n- Confirm whether the web management interface is reachable from outside the local network","needs_analyst":true,"not_affected_if":["web-interface-disabled","other-firmware"],"who_is_affected":"Owners of Tenda F6 routers running firmware 12.02.01.73 who use the web management interface. Exposure depends on whether an attacker can reach the traffic path, which the sources do not describe in detail. Devices with the web interface disabled or limited to a trusted network are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000577,"input_tokens":3339,"output_tokens":486,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115797':12A,15A '-2026':11A,14A '12.02.01.73':29B,59C 'admin':49B 'affect':60C 'argument':34B,76C 'attack':38B,88C,94C,121C 'avail':112C 'captur':46B 'character':96C 'cleartext':9A,36B,82C 'complex':99C 'compon':67C 'could':45B,117C 'cve':10A,13A 'difficult':106C 'eco':32B,77C 'execut':71C 'exploit':101C,108C 'f6':2A,24B,58C 'function':64C 'high':98C 'host':20B 'identifi':55C 'inform':86C 'infrastructur':16B 'interfac':27B,70C 'launch':91C 'lead':80C 'login':5A 'made':111C 'manag':26B,69C 'manipul':43B,73C 'may':89C 'observ':41B 'password':7A,50B 'posit':39B 'public':115C 'pw':33B,78C 'remot':92C 'router':3A,17B,48B 'self':19B 'self-host':18B 'send':6A 'sensit':85C 'tenda':1A,21B,23B,57C 'told':103C 'traffic':44B 'transmiss':83C 'transmit':30B 'unknown':63C 'use':119C 'version':28B 'weak':52C 'web':4A,25B,68C","nicknames":[],"mitigations":[],"who_affected":"Owners of Tenda F6 routers running firmware 12.02.01.73 who use the web management interface. Exposure depends on whether an attacker can reach the traffic path, which the sources do not describe in detail. Devices with the web interface disabled or limited to a trusted network are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115797","severity":null,"published_at":"2026-10-23T20:17:21+00:00","modified_at":"2026-10-23T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}