CVE-2026-82693: Missing Authentication in Tenda AC1206

This vulnerability in Tenda AC1206 version 15.03.06.23 involves missing authentication in the TendaTelnet function of the /goform/telnet endpoint in the Web UI. An attacker can remotely manipulate this function to bypass authentication controls, potentially gaining unauthorized access. The vulnerability has been publicly disclosed with exploit details available, but no vendor fix has been confirmed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, scope, and security requirements.

Successful exploitation allows remote attackers to bypass authentication on the affected device, potentially leading to full control over the router. This can compromise network security, confidentiality, and availability of services relying on the device. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

No official patch or remediation has been announced by the vendor as of the current information. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting network access to the device's management interface and disabling Telnet services if possible may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.