CVE-2026-8263
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. The function fromSetWirelessRepeat in the file /goform/WifiExtraSet of the httpd component is affected by OS command injection via manipulation of arguments mac or ssid. The attack can be launched remotely and the exploit has been released.
Risk Assessment
A remote attacker could execute arbitrary system commands on the device, potentially leading to full control of the router and network.
Recommendation
Immediately update the device firmware to the latest version if a patch is available. Otherwise, consider decommissioning the device.
Original NVD description (English source)
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.