CVE-2022-36552
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In Tenda AC6 (AC1200) firmware version 5.0 and below (v02.03.01.114), a vulnerability exists in the /cgi-bin/DownloadFlash component. It allows an attacker to steal all data, including source code and system files, via a crafted GET request.
Risk Assessment
An attacker can remotely steal sensitive data such as software source code and system configuration files, leading to a breach of confidentiality and integrity of the device and potentially enabling further attacks on the network.
Recommendation
Immediately update the Tenda AC6 router firmware to a version newer than v02.03.01.114. If an update is not available, restrict access to the device management interface to trusted networks only.
Other vulnerabilities in Tenda AC6
See all- CVE-2026-8265Medium
A security vulnerability has been detected in Tenda AC6 15.03.06.23. The function get_log_file in the file /goform/getLogFile of the httpd component is affected by OS command injection via manipulation of the argument wans.flag. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-8263Medium
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. The function fromSetWirelessRepeat in the file /goform/WifiExtraSet of the httpd component is affected by OS command injection via manipulation of arguments mac or ssid. The attack can be launched remotely and the exploit has been released.
- CVE-2026-8259Medium
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. An unknown function in the file /goform/telnet of the httpd component is affected by OS command injection via manipulation of the argument lan.ip. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2024-52714Critical
A buffer overflow vulnerability was discovered in the 'fromSetSysTime' function of Tenda AC6 v2.0 router with firmware v15.03.06.50. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-40839Critical
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADF3C' function. In the 'formSetIptv' function, the 'list' and 'vlanId' parameters are passed unfiltered, allowing for arbitrary command execution.
- CVE-2023-40837Critical
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADD50' function. In the 'formSetIptv' function, unfiltered passing of the 'list' and 'vlanId' fields as parameters to the 'sub_ADD50' function allows for command execution.
- CVE-2022-37176Critical
A vulnerability in the firmware of Tenda AC6 (AC1200) v5.0 and below allows attackers to remove the Wi-Fi password and force the device into open security mode by sending a crafted packet to the goform/setWizard form.
- CVE-2026-8264Medium
An OS command injection vulnerability was found in Tenda AC6 router version 15.03.06.23 in the formWifiApScan function of the /goform/WifiApScan file. Manipulating the wl2g.public.country or wl5g.public.country arguments allows remote command execution. The exploit is publicly available.
- CVE-2025-46035High
A buffer overflow vulnerability was found in Tenda AC6 router firmware version 15.03.05.16. An unauthenticated remote attacker can cause a denial of service (DoS) by sending an HTTP GET request with oversized schedStartTime and schedEndTime parameters to the /goform/openSchedWifi endpoint.
Original NVD description (English source)
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request.