A critical authentication bypass flaw in Tenda AC6 V5.0 routers allows unauthenticated remote code execution, threatening the security of the entire network.

This is an authentication bypass vulnerability (CWE-288) affecting the HTTP authentication mechanism. By sending a specially crafted request, an unauthenticated attacker can bypass security controls to achieve arbitrary code execution.

Exploitation of this vulnerability allows an attacker to gain full control over the affected Tenda router, facilitating network surveillance, traffic interception, or the deployment of botnet malware. The CVSS score of 9.8 reflects the high risk of total system takeover and the potential for lateral movement within the network.

Immediate Action: Check the Tenda support portal for firmware updates addressing this vulnerability and apply them immediately.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests targeting router administrative interfaces and check system logs for unauthorized configuration changes.

Compensating Controls: Restrict access to the router's web management interface by disabling remote management and limiting access to trusted local IP addresses only.

Public Exploit Available: Unknown — there is no confirmed public weaponized exploit or public PoC in our current data.

Given the critical nature of this authentication bypass, users should treat this as a high-priority security event. If a firmware update is not yet available, immediately disable external management access to the device to reduce the attack surface until the vendor provides a formal resolution.