EUVD-2026-29015
GHSA-59c7-jp82-73fm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with admin credentials
-
DeliveryCraft malicious /goform/telnet request with shell-injected lan.ip
-
Exploithttpd parses and executes injected commands
-
ExecutionArbitrary OS command runs as httpd user
-
ImpactSystem compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires high-level administrative authentication (PR:H) - the attacker must possess valid admin credentials to access the /goform/telnet endpoint and manipulate the lan.ip parameter. The endpoint appears to be accessible over the network (AV:N) with low attack complexity (AC:L), but the authentication barrier is the critical limiting factor. No evidence suggests unauthenticated exploitation is possible or that a default admin password bypass exists in this specific CVE. Deployment as a publicly-exposed router (WAN-facing httpd) increases network accessibility, but the admin credential requirement prevents random Internet-scale scanning attacks. |
| Impact | CVSS score of 4.7 reflects low-to-medium severity due to the high-privilege requirement (PR:H), limiting real-world risk despite network vector and low attack complexity. EPSS data not provided. The CVSS vector shows E:P (exploit proof-of-concept publicly available) and RC:R (reasonable confidence), confirming public exploit availability. However, the PR:H (high privilege required) constraint significantly reduces practical risk - only users with administrative credentials can trigger the vulnerability, making opportunistic mass exploitation unlikely. The Scope:Unchanged (SU) designation indicates no privilege escalation to other system components. This is a lower-priority vulnerability for most environments unless rogue admins or compromised admin accounts are a threat model. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials authenticates to the Tenda AC6 web management interface, navigates to or crafts a request to /goform/telnet with a malicious lan.ip parameter containing shell metacharacters (e.g., lan.ip=192.168.1.1;cat%20/etc/passwd), which are executed as OS commands by httpd. Publicly available exploit code on GitHub demonstrates this attack with specific payload syntax. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 11, 2026
OS command injection in Tenda AC6 2.0/15.03.06.23 httpd daemon allows authenticated remote attackers to execute arbitrary system commands via the lan.ip parameter in /goform/telnet endpoint. The vulnerability requires high-level administrative privileges and has publicly available exploit code; real-world risk is limited by authentication requirement despite network accessibility and low attack complexity.
RemediationAI
Apply a firmware update to Tenda AC6 if available from the vendor; check Tenda.com.cn for the latest stable release beyond 15.03.06.23. As an immediate workaround, restrict administrative access to the web management interface to trusted networks only by disabling remote management or implementing firewall rules to block WAN access to the httpd port (typically TCP 80/443). Disable or remove the /goform/telnet endpoint if not required for legitimate telnet proxy functionality. Monitor administrative user activity for suspicious command sequences. Note that these workarounds do not remove the vulnerability itself and only reduce attack surface for externally-facing threats; replace with a vendor patch as soon as available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda AC6 is a residential wireless router with a web-based management interface served by the httpd component. The vulnerability exists in the /goform/telnet endpoint, which processes the lan.ip argument without proper sanitization before passing it to OS command execution. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the root cause is inadequate input validation that allows shell metacharacters to be injected into system commands. The CPE cpe:2.3:a:tenda:ac6:*:*:*:*:*:*:*:* indicates all versions of the Tenda AC6 product family are affected.
Know when Ac6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Tenda AC6 Command Injection Vulnerabilities
View all 4Remote attackers with low-level authentication can execute arbitrary code on Tenda AC6 routers running firmware version
Stack-based buffer overflow in Tenda AC6 router firmware version 15.03.05.16 enables authenticated remote attackers to a
Exploit-DB