CVE-2026-8264
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
An OS command injection vulnerability was found in Tenda AC6 router version 15.03.06.23 in the formWifiApScan function of the /goform/WifiApScan file. Manipulating the wl2g.public.country or wl5g.public.country arguments allows remote command execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely take over the router, leading to full compromise of the device and potential access to the internal network.
Recommendation
Immediately update the router firmware to the latest available version or consider replacing the device if no patch is provided.
Original NVD description (English source)
A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.