Is there a public PoC exploit available for CVE-2026-8264?

Yes, a public proof-of-concept exploit is available for CVE-2026-8264. Prioritise patching immediately. EPSS: 2.7%.

Tenda AC6 CVE-2026-8264

Q: What is the CVSS score of CVE-2026-8264?

CVE-2026-8264 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.7%.

EUVD-2026-29020 LOW

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-2fpj-h75c-c5vr

Tenda Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 04:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 03:45 vuln.today

CVE Published

May 11, 2026 - 02:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote authenticated command injection in Tenda AC6 router firmware version 15.03.06.23 allows authenticated attackers to execute arbitrary OS commands via manipulation of the wl2g.public.country or wl5g.public.country parameters in the /goform/WifiApScan endpoint. The vulnerability affects the httpd component's formWifiApScan function and has publicly available exploit code, presenting moderate risk to affected deployments.

Technical ContextAI

The Tenda AC6 is a dual-band WiFi router that exposes web-based management interfaces through an embedded httpd service. The vulnerability exists in the formWifiApScan function, which processes country code parameters for 2.4GHz (wl2g) and 5GHz (wl5g) wireless bands without proper input validation or sanitization. These parameters are passed directly to OS-level commands without escaping shell metacharacters, enabling command injection attacks. The root cause falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection flaw where user-supplied input is concatenated into system commands without proper defense mechanisms such as parameterized APIs, allowlisting, or shell escaping.

RemediationAI

Immediate mitigation requires upgrading the Tenda AC6 firmware to a patched version released by Tenda, if available. Check the Tenda support portal (www.tenda.com.cn) for the latest firmware release addressing CVE-2026-8264 and apply it immediately to all affected devices. If a patched firmware version is not yet available, implement the following compensating controls: restrict web management interface access to trusted networks only by configuring firewall rules to block HTTP/HTTPS access (ports 80 and 443) from untrusted networks, change default router credentials to strong, unique passwords to prevent credential-based access, disable remote management features in the router's web interface settings if not required for operations, and monitor httpd logs for suspicious POST requests to /goform/WifiApScan with country parameter values containing shell metacharacters (pipes, semicolons, backticks, dollar signs). These controls do not eliminate the vulnerability but significantly reduce attack surface while awaiting a vendor patch.