Description
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
Published: 2026-10-23
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Sensitive Information Disclosure via Cleartext Transmission
Action: Patch firmware
AI Analysis

Impact

A weakness exists in the Web Management Interface of the Tenda F6 router that allows an attacker to manipulate the *ecos_pw* argument, resulting in the transmission of sensitive data in cleartext. The attack is remote and requires high complexity, but a public exploit has already been released, indicating that the vulnerability can be leveraged by attackers who can reach the router’s management interface.

Affected Systems

The vulnerability is present only in Tenda F6 devices running firmware version 12.02.01.73. No other firmware versions are known to be affected at this time.

Risk and Exploitability

The CVSS score of 6.3 highlights a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the exploit is available publicly and the attack can be launched remotely, the risk remains present for exposed devices even though the exploitability is described as difficult. Administrators should consider immediate patching or other mitigation measures.

Generated by OpenCVE AI on October 23, 2026 at 22:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Tenda F6 router to the latest firmware that resolves the cleartext transmission issue
  • Limit access to the Web Management Interface to trusted IP addresses or a VPN tunnel
  • If HTTPS is supported, configure the router to use HTTPS only; otherwise disable the web management feature when remote access is not required

Generated by OpenCVE AI on October 23, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
Title Tenda F6 Web Management cleartext transmission
First Time appeared Tenda
Tenda f6
Weaknesses CWE-310
CWE-319
CPEs cpe:2.3:h:tenda:f6:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda f6
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda F6
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-23T20:00:16.370Z

Reserved: 2026-10-23T14:57:47.218Z

Link: CVE-2026-115797

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T20:17:21.693

Modified: 2026-10-23T20:17:21.693

Link: CVE-2026-115797

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T22:15:17Z

Weaknesses