Is there a public PoC exploit available for CVE-2026-8259?

Yes, a public proof-of-concept exploit is available for CVE-2026-8259. Prioritise patching immediately. EPSS: 0.6%.

Tenda AC6 CVE-2026-8259

Q: What is the CVSS score of CVE-2026-8259?

CVE-2026-8259 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-29015 LOW

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-59c7-jp82-73fm

Tenda Command Injection Ac6

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 02:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 11, 2026 - 02:00 vuln.today

CVE Published

May 11, 2026 - 01:00 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

OS command injection in Tenda AC6 2.0/15.03.06.23 httpd daemon allows authenticated remote attackers to execute arbitrary system commands via the lan.ip parameter in /goform/telnet endpoint. The vulnerability requires high-level administrative privileges and has publicly available exploit code; real-world risk is limited by authentication requirement despite network accessibility and low attack complexity.

Technical ContextAI

Tenda AC6 is a residential wireless router with a web-based management interface served by the httpd component. The vulnerability exists in the /goform/telnet endpoint, which processes the lan.ip argument without proper sanitization before passing it to OS command execution. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the root cause is inadequate input validation that allows shell metacharacters to be injected into system commands. The CPE cpe:2.3:a:tenda:ac6:*:*:*:*:*:*:*:* indicates all versions of the Tenda AC6 product family are affected.

RemediationAI

Apply a firmware update to Tenda AC6 if available from the vendor; check Tenda.com.cn for the latest stable release beyond 15.03.06.23. As an immediate workaround, restrict administrative access to the web management interface to trusted networks only by disabling remote management or implementing firewall rules to block WAN access to the httpd port (typically TCP 80/443). Disable or remove the /goform/telnet endpoint if not required for legitimate telnet proxy functionality. Monitor administrative user activity for suspicious command sequences. Note that these workarounds do not remove the vulnerability itself and only reduce attack surface for externally-facing threats; replace with a vendor patch as soon as available.