CVE-2026-8265
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A security vulnerability has been detected in Tenda AC6 15.03.06.23. The function get_log_file in the file /goform/getLogFile of the httpd component is affected by OS command injection via manipulation of the argument wans.flag. The attack can be launched remotely and the exploit has been disclosed.
Risk Assessment
A remote attacker could execute arbitrary system commands on the device, potentially leading to full control of the router and network.
Recommendation
Immediately update the device firmware to the latest version if a patch is available. Otherwise, consider decommissioning the device.
Original NVD description (English source)
A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.