# CVE-2026-115796: Tenda F6 cross-site request forgery in web management interface

Source: https://junglewise.ai/threats/cve-2026-115796-a-security-flaw-has-been-discovered-in-tenda-f6-12-02-01-73-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115796 · Severity: medium · CVSS 4.3 · Published 2026-10-23

The Tenda F6 wireless router's web administration interface lacks protection against cross-site request forgery (CSRF) attacks. An attacker can trick a logged-in administrator into visiting a malicious webpage to silently execute administrative commands, such as factory reset or password change, resulting in complete loss of device control and Wi-Fi credential exposure.

Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-115796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115796 being exploited in the wild.

**How severe is CVE-2026-115796?** Medium severity, with a CVSS score of 4.3, published 23 October 2026.

**Which products and versions are affected?** Tenda F6 12.02.01.73.

**Is there a fix for CVE-2026-115796?** No fixed version is recorded yet. Implement anti-CSRF tokens on all state-changing requests, set session cookies to SameSite=Strict with HttpOnly and Secure flags, and require re-authentication for sensitive operations such as password change and factory restore.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Public disclosure via GitHub and NVD"},{"kind":"other","at":"2026-10-09","note":"Reported to vendor; awaiting response"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115796 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-115796?** Check whether you run Tenda F6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Implement anti-CSRF tokens on all state-changing requests, set session cookies to SameSite=Strict with HttpOnly and Secure flags, and require re-authentication for sensitive operations such as password change and factory restore.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Public disclosure via GitHub and NVD"},{"kind":"other","at":"2026-10-09","note":"Reported to vendor; awaiting response"}]

## Technical details

The web management interface at 192.168.0.1 accepts state-changing POST requests to /goform/ endpoints without CSRF tokens or SameSite cookie restrictions. An authenticated attacker can craft an HTML form that, when visited by an admin, automatically submits factory reset, reboot, or password-change requests. The attack requires the victim to have an active authenticated session and is limited to adjacent network access (LAN), though enabling remote management would elevate this to a network-accessible vector.

## Affected products

- Tenda F6 12.02.01.73

## References

- [https://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md](https://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md)
- [https://vuldb.com/cve/CVE-2026-115796](https://vuldb.com/cve/CVE-2026-115796)