CVE-2026-8264
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
An OS command injection vulnerability was found in Tenda AC6 router version 15.03.06.23 in the formWifiApScan function of the /goform/WifiApScan file. Manipulating the wl2g.public.country or wl5g.public.country arguments allows remote command execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely take over the router, leading to full compromise of the device and potential access to the internal network.
Recommendation
Immediately update the router firmware to the latest available version or consider replacing the device if no patch is provided.
Other vulnerabilities in Tenda AC6
See all- CVE-2026-8265Medium
A security vulnerability has been detected in Tenda AC6 15.03.06.23. The function get_log_file in the file /goform/getLogFile of the httpd component is affected by OS command injection via manipulation of the argument wans.flag. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-8263Medium
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. The function fromSetWirelessRepeat in the file /goform/WifiExtraSet of the httpd component is affected by OS command injection via manipulation of arguments mac or ssid. The attack can be launched remotely and the exploit has been released.
- CVE-2026-8259Medium
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. An unknown function in the file /goform/telnet of the httpd component is affected by OS command injection via manipulation of the argument lan.ip. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2024-52714Critical
A buffer overflow vulnerability was discovered in the 'fromSetSysTime' function of Tenda AC6 v2.0 router with firmware v15.03.06.50. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-40839Critical
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADF3C' function. In the 'formSetIptv' function, the 'list' and 'vlanId' parameters are passed unfiltered, allowing for arbitrary command execution.
- CVE-2023-40837Critical
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADD50' function. In the 'formSetIptv' function, unfiltered passing of the 'list' and 'vlanId' fields as parameters to the 'sub_ADD50' function allows for command execution.
- CVE-2022-37176Critical
A vulnerability in the firmware of Tenda AC6 (AC1200) v5.0 and below allows attackers to remove the Wi-Fi password and force the device into open security mode by sending a crafted packet to the goform/setWizard form.
- CVE-2025-46035High
A buffer overflow vulnerability was found in Tenda AC6 router firmware version 15.03.05.16. An unauthenticated remote attacker can cause a denial of service (DoS) by sending an HTTP GET request with oversized schedStartTime and schedEndTime parameters to the /goform/openSchedWifi endpoint.
- CVE-2022-36552High
In Tenda AC6 (AC1200) firmware version 5.0 and below (v02.03.01.114), a vulnerability exists in the /cgi-bin/DownloadFlash component. It allows an attacker to steal all data, including source code and system files, via a crafted GET request.
Original NVD description (English source)
A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.