The vulnerability originates from the check_is_ipv6 function in the IPv6 Handler of the Tenda AC8 firmware. The implementation improperly relies on the client’s IPv6 address to satisfy authentication conditions, allowing an attacker to bypass normal credential checks. Consequently, an attacker who successfully bypasses authentication could gain administrative access to the router’s web interface, potentially compromising the confidentiality, integrity, and availability of the network. The weakness corresponds to authentication bypass (CWE‑287) and improper authorization (CWE‑291).

Devices affected by this defect are Tenda AC8 routers running firmware version 16.03.50.11. The CPE entries indicate that the firmware product and the hardware model are susceptible. No other product versions or vendors are listed, so only current AC8 devices with the specified firmware are at risk.

The assigned CVSS score of 9.3 denotes critical severity. The EPSS score is below 1% , implying that large‑scale exploitation is unlikely at present, yet a publicly available proof‑of‑concept on GitHub demonstrates that the exploit is reachable. Based on the description, the exploit can be launched remotely through the router’s management interface; it does not require physical access. As the flaw is not listed in the CISA KEV catalog, no mass‑distribution is recorded, but the risk remains high because successful authentication bypass directly grants privileged control over the device.