CVE-2026-8259
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. An unknown function in the file /goform/telnet of the httpd component is affected by OS command injection via manipulation of the argument lan.ip. The attack can be launched remotely and the exploit has been disclosed.
Risk Assessment
A remote attacker could execute arbitrary system commands on the device, potentially leading to full control of the router and network.
Recommendation
Immediately update the device firmware to the latest version if a patch is available. Otherwise, consider decommissioning the device.
Original NVD description (English source)
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.