CVE-2026-86300: Tenda AC9 Authentication Bypass Vulnerability

CVE-2026-86300 Overview

CVE-2026-86300 is an improper authentication weakness [CWE-287] in the Tenda AC9 wireless router, firmware version 15.03.05.14. The flaw resides in the R7WebsSecurityHandler function of the Web Management component. An unauthenticated attacker can reach the affected handler over the network and bypass authentication controls exposed by the router's web interface. A proof-of-concept exploit has been published on GitHub, increasing the likelihood of opportunistic abuse against exposed devices.

Critical Impact
Remote, unauthenticated attackers can bypass authentication in the Tenda AC9 web management interface, exposing router configuration and administrative functions.

Affected Products

Tenda AC9 router
Firmware version 15.03.05.14
R7WebsSecurityHandler function within the Web Management component

Discovery Timeline

2026-09-07 - CVE-2026-86300 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86300

Vulnerability Analysis

The vulnerability affects R7WebsSecurityHandler, a routine responsible for enforcing session and authentication checks within the Tenda AC9 Web Management interface. Improper validation inside the handler allows requests to reach protected endpoints without a valid authenticated session. Because the web service listens on the router's LAN and, when exposed, WAN interfaces, the flaw is reachable remotely with low attack complexity. The published proof-of-concept demonstrates unauthenticated interaction with sensitive setup endpoints, including WiFi password configuration.

Root Cause

The root cause is improper authentication [CWE-287] within R7WebsSecurityHandler. The handler fails to correctly verify session state or credentials for a set of administrative requests. As a result, access-control decisions are bypassed and the router treats unauthenticated requests as trusted, permitting configuration operations that should require an administrator session.

Attack Vector

Exploitation requires network access to the router's web management service. No user interaction and no prior privileges are needed. An attacker sends crafted HTTP requests to endpoints protected by R7WebsSecurityHandler, such as the fast_setting_wifi_set and getProduct interfaces referenced in the public proof-of-concept. Successful requests yield configuration disclosure or unauthorized modification of router settings, including wireless credentials. For technical details, see the GitHub PoC for Tenda AC9 and the companion information disclosure write-up.

// No verified exploit code is reproduced here.
// Refer to the linked PoC repositories for request structures and endpoint details.

Detection Methods for CVE-2026-86300

Indicators of Compromise

Unauthenticated HTTP requests to Tenda AC9 web management endpoints such as /goform/fast_setting_wifi_set or /goform/getProduct originating from unexpected sources.
Wireless SSID or password changes on the router without a corresponding administrator login event.
New or unexpected client devices associating with the wireless network after configuration changes.

Detection Strategies

Inspect router and upstream firewall logs for HTTP POST requests to goform endpoints that lack a preceding authenticated session.
Alert on any WAN-side traffic reaching TCP port 80 or 443 of Tenda AC9 devices, as management interfaces should not be internet-exposed.
Correlate configuration change events with authentication logs to surface changes that occur without a matching admin login.

Monitoring Recommendations

Enable syslog forwarding from the router to a central log store and retain web management access logs.
Monitor DHCP and wireless association logs for unexpected clients following suspicious HTTP activity.
Track firmware version and configuration baselines across managed Tenda devices to detect drift.

How to Mitigate CVE-2026-86300

Immediate Actions Required

Restrict access to the Tenda AC9 web management interface to trusted LAN segments only and disable remote WAN administration.
Place vulnerable devices behind a firewall that blocks inbound HTTP and HTTPS to the router's management IP.
Rotate the administrator password and wireless pre-shared key after confirming the device is not compromised.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Tenda official website for firmware updates and monitor the VulDB entry for CVE-2026-86300 for status changes. If no fixed firmware is available, plan for device replacement in high-risk environments.

Workarounds

Disable remote web management on the WAN interface via the router's administrative settings.
Segment the router onto an isolated management VLAN and apply ACLs that only permit administrative workstations to reach the web interface.
Where feasible, replace end-of-support Tenda AC9 units with actively maintained hardware that receives security updates.

bash

# Example firewall rule to block WAN access to the router's web management port
iptables -A INPUT -i <wan_interface> -p tcp --dport 80 -j DROP
iptables -A INPUT -i <wan_interface> -p tcp --dport 443 -j DROP