EUVD-2026-19042
GHSA-5xr7-9jmx-g4x4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.3 (Medium) with AV:N (network-accessible), AC:L (low complexity), and PR:L (low privilege requirement) indicates a moderate baseline risk. However, multiple risk signals elevate practical concern: the attack vector is remote and unauthenticated traffic can reach the vulnerable function, CVSS explicitly specifies low privilege requirements (authentication), and proof-of-concept documentation is publicly available on GitHub. The scope is Unchanged (S:U) and impact is limited (Confidentiality, Integrity, and Availability all Low), but for an embedded router device, local code execution as the httpd user may enable lateral movement to the broader network. SSVC considerations: exploitation status is publicly documented (POC availability), the attack is likely automatable through parameter manipulation, and technical impact reaches to system-level command execution. This represents a real priority for deployed AC10 devices in enterprise or security-sensitive environments, despite the medium CVSS score-the combination of remote accessibility, low authentication bar, and code execution capability warrants prioritization. |
| Exploit ScenarioDerived | An attacker with valid credentials to the Tenda AC10 web interface (obtained via default credentials, credential stuffing, or phishing) navigates to the MAC filtering configuration page and injects OS commands into the MAC address or rule name fields passed to formAddMacfilterRule. Upon form submission, the injected commands are executed by the httpd process with its inherited privileges, potentially allowing the attacker to read sensitive configuration files, modify firewall rules, or pivot to other devices on the network. Proof-of-concept exploitation steps are documented in the public GitHub repository, lowering the barrier for attackers to weaponize this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arbitrary system commands via the formAddMacfilterRule function in /bin/httpd. The vulnerability requires valid credentials (PR:L in CVSS vector) and affects multiple endpoints related to MAC filtering configuration. No public exploit code has been independently confirmed as actively exploited, though proof-of-concept documentation exists in public repositories.
RemediationAI
Upgrade Tenda AC10 firmware to a patched version released by Tenda. Exact patched firmware version numbers are not specified in available data; users should check Tenda's official support portal (https://www.tenda.com.cn/) for the latest firmware release and security advisories for the AC10 model. As an interim mitigation, restrict access to the router's web management interface to trusted networks only, disable remote management if not required, and enforce strong credentials for administrative accounts. Additional technical details and proof-of-concept information are documented at https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-03-command-injection-formaddmacfilterrule.md and https://vuldb.com/vuln/355311.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the HTTP daemon (/bin/httpd) of Tenda AC10 wireless router firmware, specifically in the formAddMacfilterRule function responsible for handling MAC address filtering rule additions. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates insufficient input validation or output encoding of user-supplied parameters before passing them to OS command execution functions. Tenda AC10 is a consumer-grade dual-band WiFi router; the httpd service typically runs with elevated privileges, making command injection highly impactful. The CPE cpe:2.3:a:tenda:ac10:*:*:*:*:*:*:*:* indicates all versions of the AC10 product line may be affected, though the specific vulnerable version identified is 16.03.10.10_multi_TDE01.
Know when Ac10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Tenda AC10 Command Injection and Hardcoded Key
View all 2Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumve
Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated a
Stack-based buffer overflow in Tenda AC10 router firmware version 16.03.10.10_multi_TDE01 allows authenticated remote at
Stack-based buffer overflow in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers
Exploit-DB