---
id: "CVE-2026-115797"
kind: "vulnerability"
aliases: ["CVE-2026-115797"]
title: "Tenda F6 router: web login sends password in cleartext"
severity: "low"
cvss: 3.7
epss: 0.00307
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "router", "self-hosted", "tenda"]
not_affected_if: ["other-firmware", "web-interface-disabled"]
published_at: "2026-10-23T20:17:21+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115797", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115797", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Tenda F6 router: web login sends password in cleartext

The Tenda F6 web management interface, version 12.02.01.73, transmits the ecos_pw argument in cleartext. An attacker positioned to observe or manipulate traffic could capture the router admin password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version under the router's status page and compare it to `12.02.01.73`
- Confirm whether the web management interface is reachable from outside the local network

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115797
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115797

## From the sources

A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_