Tenda AC6 CVE-2026-8263

Q: What is the CVSS score of CVE-2026-8263?

CVE-2026-8263 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-29019 LOW

Command Injection (CWE-77)

2026-05-11 cna@vuldb.com

GHSA-49r7-qrrc-gw83

Command Injection Tenda Ac10U Firmware

2.0

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 02:30 vuln.today

CVE Published

May 11, 2026 - 02:16 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Tenda AC6 firmware version 15.03.06.49_multi_TDE01 allows high-privilege remote attackers to execute arbitrary commands via manipulation of mac/ssid parameters in the fromSetWirelessRepeat function exposed through the /goform/WifiExtraSet HTTP endpoint. Public exploit code is available, though the CVSS 2.0 score reflects limited impact scope due to requirement of high-privilege authentication and minimal confidentiality/integrity/availability effects beyond low-severity damage.

Technical ContextAI

The vulnerability exists in the httpd web server component of Tenda AC6 router firmware, specifically in the wireless repeat configuration handler. The /goform/WifiExtraSet endpoint processes user-supplied mac and ssid parameters through the fromSetWirelessRepeat function without proper input validation or sanitization before passing them to OS command execution contexts. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the root cause is a classic command injection flaw where attacker-controlled input is concatenated into shell commands. This is typical of embedded device firmware that often lacks mature input validation practices. The vulnerability is present in the Tenda AC6 mesh Wi-Fi router's firmware, a budget-oriented dual-band access point commonly deployed in home and small office networks.

RemediationAI

No vendor-released patch has been identified at time of analysis. Tenda's official advisory at https://www.tenda.com.cn/ should be monitored for firmware updates addressing this command injection. Immediate mitigation: (1) Change default admin credentials to a strong, unique password - this directly negates the PR:H (high privilege) requirement by making unauthorized admin access infeasible; this is the PRIMARY compensating control and should be mandatory for all Tenda AC6 deployments regardless of update status. (2) Disable remote management/WAN access to the httpd admin interface if not actively required; configure firewall rules to restrict access to /goform/ endpoints to LAN-only clients, limiting attack surface to local network attackers with existing network access. (3) Isolate the Tenda AC6 on a dedicated management VLAN if deployed in enterprise/shared environments to prevent compromised client devices from reaching the admin interface. (4) Monitor for firmware updates from Tenda and apply immediately upon release. Note: These mitigations do NOT eliminate the flaw but raise the barrier to exploitation sufficiently that automated or casual attacks become impractical.