Is there a public PoC exploit available for CVE-2026-8265?

Yes, a public proof-of-concept exploit is available for CVE-2026-8265. Prioritise patching immediately. EPSS: 0.6%.

Tenda AC6 CVE-2026-8265

Q: What is the CVSS score of CVE-2026-8265?

CVE-2026-8265 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-29022 LOW

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-qvqp-rwfh-7f5j

Tenda Command Injection

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 04:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 11, 2026 - 03:45 vuln.today

CVE Published

May 11, 2026 - 02:30 nvd

MEDIUM 4.7

DescriptionCVE.org

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Remote command injection in Tenda AC6 version 15.03.06.23 allows authenticated remote attackers to execute arbitrary OS commands via the wans.flag parameter in the /goform/getLogFile endpoint. The vulnerability has publicly available exploit code and may be actively exploited. Attack complexity is low, requiring only network access and high-level authentication privileges, with potential for confidentiality, integrity, and authenticity impacts.

Technical ContextAI

The vulnerability exists in the httpd component's get_log_file function, which processes user-supplied input from the wans.flag parameter without proper sanitization. This is a classic OS command injection flaw (CWE-78) where attacker-controlled data is passed directly to shell command execution routines. The Tenda AC6 is a wireless router device running embedded Linux firmware with a web-based management interface. The /goform/getLogFile endpoint is part of the device's HTTP daemon and is accessible remotely, but requires high-level authentication (PR:H in CVSS vector) to exploit, suggesting admin or privileged user credentials are needed.

RemediationAI

Upgrade Tenda AC6 firmware to a patched version released after version 15.03.06.23. Consult the Tenda official website (https://www.tenda.com.cn/) for the latest firmware release and security advisories for AC6. If a patched firmware version is not yet available, implement the following compensating controls: restrict administrative access to the router's web interface by limiting management access to trusted IP addresses only using firewall rules or built-in access control lists; disable remote management of the device if not required (disable WAN-side access to the HTTP management interface); enforce strong administrative passwords (minimum 16 characters, mixed case, numbers, and special characters) and rotate credentials regularly; monitor access logs to /goform/getLogFile for suspicious activity with wans.flag parameters; isolate the router on a separate management network with restricted access. Note: these controls do not eliminate the vulnerability but reduce attack surface and detection difficulty.