CVE-2026-5547
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
In the Tenda AC10 router version 16.03.10.10_multi_TDE01, the function formAddMacfilterRule in file /bin/httpd is vulnerable to OS command injection. The attack can be performed remotely, and multiple endpoints may be affected.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to full control of the router and network.
Recommendation
It is recommended to immediately update the Tenda AC10 firmware to the latest available version. If no update is available, consider restricting access to the management interface.
Original NVD description (English source)
A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.