CVE-2023-40839
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADF3C' function. In the 'formSetIptv' function, the 'list' and 'vlanId' parameters are passed unfiltered, allowing for arbitrary command execution.
Risk Assessment
This vulnerability could lead to unauthorized command execution, posing a significant security risk to the organization's network.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and implement additional security measures.
Other vulnerabilities in Tenda AC6
See all- CVE-2026-8265Medium
A security vulnerability has been detected in Tenda AC6 15.03.06.23. The function get_log_file in the file /goform/getLogFile of the httpd component is affected by OS command injection via manipulation of the argument wans.flag. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-8263Medium
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. The function fromSetWirelessRepeat in the file /goform/WifiExtraSet of the httpd component is affected by OS command injection via manipulation of arguments mac or ssid. The attack can be launched remotely and the exploit has been released.
- CVE-2026-8259Medium
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. An unknown function in the file /goform/telnet of the httpd component is affected by OS command injection via manipulation of the argument lan.ip. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2024-52714Critical
A buffer overflow vulnerability was discovered in the 'fromSetSysTime' function of Tenda AC6 v2.0 router with firmware v15.03.06.50. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-40837Critical
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADD50' function. In the 'formSetIptv' function, unfiltered passing of the 'list' and 'vlanId' fields as parameters to the 'sub_ADD50' function allows for command execution.
- CVE-2022-37176Critical
A vulnerability in the firmware of Tenda AC6 (AC1200) v5.0 and below allows attackers to remove the Wi-Fi password and force the device into open security mode by sending a crafted packet to the goform/setWizard form.
- CVE-2026-8264Medium
An OS command injection vulnerability was found in Tenda AC6 router version 15.03.06.23 in the formWifiApScan function of the /goform/WifiApScan file. Manipulating the wl2g.public.country or wl5g.public.country arguments allows remote command execution. The exploit is publicly available.
- CVE-2025-46035High
A buffer overflow vulnerability was found in Tenda AC6 router firmware version 15.03.05.16. An unauthenticated remote attacker can cause a denial of service (DoS) by sending an HTTP GET request with oversized schedStartTime and schedEndTime parameters to the /goform/openSchedWifi endpoint.
- CVE-2022-36552High
In Tenda AC6 (AC1200) firmware version 5.0 and below (v02.03.01.114), a vulnerability exists in the /cgi-bin/DownloadFlash component. It allows an attacker to steal all data, including source code and system files, via a crafted GET request.
Original NVD description (English source)
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters to the "sub_ADF3C" function to execute commands.