The vulnerability resides in the Web Management Interface of Tenda F6 routers running firmware 12.02.01.73. By manipulating an unknown function, an unauthenticated remote attacker can craft a forged request that the router will accept and execute. The flaw is a classic CSRF condition, allowing the attacker to trigger privileged actions such as configuration changes or firmware updates without the user’s knowledge, potentially compromising the device’s integrity and availability.

This issue affects Tenda F6 routers operated with firmware build 12.02.01.73. No other firmware versions are listed as impacted, so users should verify that their device is not running this specific build or that it has been updated to a fixed version.

The CVSS score of 5.3 signals a medium severity. EPSS data is not available, so exploitation probability cannot be measured from the current data set. The vulnerability is not listed in the CISA KEV catalog, yet online references confirm that a public exploit has been released and can be deployed remotely, which raises the threat level for exposed web‑management interfaces.