CVE-2026-86300: Improper Authentication in Tenda AC9

This vulnerability in Tenda AC9 version 15.03.05.14 involves improper authentication in the R7WebsSecurityHandler function of the Web Management component. The flaw allows remote attackers to bypass authentication controls, potentially gaining unauthorized access to the device's management interface. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been published, but there is no indication of active exploitation in the wild. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms on the Tenda AC9 device, potentially leading to unauthorized access to the web management interface. This could enable further malicious actions such as configuration changes or device compromise. However, no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider limiting remote access to the device's management interface and monitoring for suspicious activity related to authentication bypass attempts.