Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-4252 is a high-severity Improper Authentication (CWE-287) vulnerability in Tenda Ac8 Firmware. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 33% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-4252 is a critical authentication vulnerability affecting the Tenda AC8 router on firmware version 16.03.50.11. The issue resides in the check_is_ipv6 function of the IPv6 Handler component, where the system improperly relies on IP addresses for authentication, enabling bypass of security controls. Published on 2026-03-16, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs 287 (Improper Authentication) and 291 (Trusting Network Address).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By manipulating IPv6 handling, adversaries can bypass authentication to gain unauthorized access to the device, potentially achieving high impacts on confidentiality, integrity, and availability, such as executing arbitrary commands or altering configurations.
A proof-of-concept exploit demonstrating the IPv6 authentication bypass is publicly available on GitHub (https://github.com/digitalandrew/tenda_ac8_v5/blob/main/poc_ipv6_auth_bypass.py). VulDB provides detailed advisories (https://vuldb.com/?ctiid.351210, https://vuldb.com/?id.351210, https://vuldb.com/?submit.771759), and the vendor's site is at https://www.tenda.com.cn/. No specific patches or mitigations are detailed in the references.
The exploit is publicly available and might be used in the wild, increasing the risk for exposed Tenda AC8 devices.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12470
Vulnerability Data
A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The…
more
exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 5 OS baselines
V6.4.4V6.5.4V6.5.5V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Enforces access only after approved authorizations, which presupposes correct authentication has occurred.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Managed identities and credentials supplant weak IP-based authentication decisions.
PR.AA-04 directly enables verification of identity assertions (mostly preventing CWE-287 in that scope) yet leaves many other authentication failure modes unaddressed (only partial prevention overall).
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.
Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.
Access-control policy can mandate stronger authentication than IP address alone.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
Access-rights assignment should be tied to authenticated identities, not network location.
Privileged-access rules require authenticated users rather than implicit IP trust.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-287
RHEL 7 (3 rules)
- V-204425 The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password. prevents CWE-287
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-287
- V-204424 The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. prevents CWE-287
RHEL 8 (1 rule)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-287
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
Ubuntu 24.04 (2 rules)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
- V-270714 Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. prevents CWE-287