Tenda AC6 CVE-2026-8264

Authentication to the Tenda AC6 web management interface is required; the CVSS vector PR:L confirms this is not an unauthenticated vulnerability. The attacker must have network access to reach the httpd service (typically on the router's LAN or via exposed WAN management). The vulnerability is triggered by sending a crafted request to the /goform/WifiApScan endpoint with malicious country code values in the wl2g.public.country or wl5g.public.country parameters. No special firmware configuration is required beyond the default httpd service being enabled, which is standard in Tenda AC6 deployments. Default Tenda router credentials (commonly 'admin/admin' or firmware-specific defaults) significantly lower the exploitation barrier. The low attack complexity (AC:L) indicates no special timing, race conditions, or environmental conditions are required once authenticated access is established.

The CVSS 6.3 score reflects a network-accessible vulnerability with low attack complexity but requiring authenticated access (PR:L). The EPSS evidence tag (E:P) indicates proof-of-concept availability, confirming public exploit code exists. Active exploitation in the wild is not confirmed by CISA KEV status in the provided data. The authentication requirement significantly reduces real-world risk compared to unauthenticated network vulnerabilities: an attacker must first gain valid credentials to the router's web interface, typically requiring network access to the router's LAN or pre-compromised credentials. However, default credentials for Tenda routers are often weak or documented, and many users do not change default access controls. The combination of public exploit code and authenticated-only access creates a moderate risk profile - high for compromised networks or devices with default credentials, but not an immediate remote-unauthenticated threat. The command injection nature (CWE-78) allows full OS command execution with httpd process privileges, typically root on embedded systems, making the technical impact severe once authentication is bypassed.

An attacker with valid credentials to the Tenda AC6 web management interface (obtained via default credentials, credential stuffing, or network-based access to the LAN) crafts a POST request to /goform/WifiApScan with a malicious country code parameter such as 'wl2g.public.country=US; malicious_command' or using command substitution syntax. The httpd service processes this unsanitized input, executes the injected command with root privileges, and allows the attacker to install backdoors, exfiltrate data, pivot to other network devices, or disable security features. Publicly available exploit code (referenced in GitHub) automates this attack, lowering the skill barrier for attackers.