Medium severity · published Jun 8, 2026
CVE-2026-11493
Tenda AC15 Samba smb.conf weak password
5.0
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC15 · Tenda
15.03.05.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11493
vuldb.com
https://vuldb.com/cve/CVE-2026-11493
vuldb.com
https://vuldb.com/submit/834818
vuldb.com
https://vuldb.com/vuln/369113
vuldb.com
https://vuldb.com/vuln/369113/cti
www.notion.so
https://www.notion.so/Tenda-AC15-V15-03-05-19-3671f5ba98908023b508dc0330624dcd?source=copy_link
www.tenda.com.cn
https://www.tenda.com.cn/
More from AC15
9.8
CVE-2020-10987
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
9.8
CVE-2026-24103
A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi
9.8
CVE-2026-24101
An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi
9.8
CVE-2026-24105
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi
9.8
CVE-2026-3400
Tenda AC15 TextEditingConversion stack-based overflow