Is CVE-2026-115796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115796 being exploited in the wild.

How severe is CVE-2026-115796?

Medium severity, with a CVSS score of 4.3, published 23 October 2026.

Is there a fix for CVE-2026-115796?

No fixed version is recorded yet. Implement anti-CSRF tokens on all state-changing requests, set session cookies to SameSite=Strict with HttpOnly and Secure flags, and require re-authentication for sensitive operations such as password change and factory restore. [{"kind":"disclosed","at":"2026-10-23","note":"Public disclosure via GitHub and NVD"},{"kind":"other","at":"2026-10-09","note":"Reported to vendor; awaiting response"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-115796 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-115796?

Check whether you run Tenda F6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115796: Tenda F6 cross-site request forgery in web management interface

CVE-2026-115796 · Severity: medium · CVSS 4.3 · Published 2026-10-23

The Tenda F6 wireless router's web administration interface lacks protection against cross-site request forgery (CSRF) attacks. An attacker can trick a logged-in administrator into visiting a malicious webpage to silently execute administrative commands, such as factory reset or password change, resulting in complete loss of device control and Wi-Fi credential exposure.

Vendors: Tenda.

Quick answers

Is CVE-2026-115796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115796 being exploited in the wild.
How severe is CVE-2026-115796?: Medium severity, with a CVSS score of 4.3, published 23 October 2026.
Which products and versions are affected?: Tenda F6 12.02.01.73.
Is there a fix for CVE-2026-115796?: No fixed version is recorded yet. Implement anti-CSRF tokens on all state-changing requests, set session cookies to SameSite=Strict with HttpOnly and Secure flags, and require re-authentication for sensitive operations such as password change and factory restore.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Public disclosure via GitHub and NVD"},{"kind":"other","at":"2026-10-09","note":"Reported to vendor; awaiting response"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115796 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-115796?: Check whether you run Tenda F6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement anti-CSRF tokens on all state-changing requests, set session cookies to SameSite=Strict with HttpOnly and Secure flags, and require re-authentication for sensitive operations such as password change and factory restore.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Public disclosure via GitHub and NVD"},{"kind":"other","at":"2026-10-09","note":"Reported to vendor; awaiting response"}]

Technical details

The web management interface at 192.168.0.1 accepts state-changing POST requests to /goform/ endpoints without CSRF tokens or SameSite cookie restrictions. An authenticated attacker can craft an HTML form that, when visited by an admin, automatically submits factory reset, reboot, or password-change requests. The attack requires the victim to have an active authenticated session and is limited to adjacent network access (LAN), though enabling remote management would elevate this to a network-accessible vector.

Affected products

Tenda F6 12.02.01.73

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.