A weakness in the Samba configuration file on the Tenda AC15 router allows weak password requirements to be enforced, enabling local users to authenticate with insufficient credentials. The vulnerability is linked to an unknown function in /etc_ro/smb.conf and is classified as CWE‑521, involving weak authentication. Exploitation requires local network access and a high complexity level, but public exploit code is available, indicating that the attack is possible in practice.

The affected product is the Tenda AC15 router, firmware version 15.03.05.19, as identified by the CNA vendor/product list. The vulnerable component is the Samba service that ships with the firmware, with its configuration located in /etc_ro/smb.conf.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because exploitation is limited to a local network, the attack vector is likely local. Although the complexity is high and effectiveness is considered difficult, public exploit code has been released, which could be used by an attacker with local network access to bypass password controls and gain unauthorized access to the device or shared resources.