Tenda AC6 EUVD-2026-29022

Exploitation requires valid high-level authentication credentials (administrator account) to access the /goform/getLogFile endpoint. The Tenda AC6 device must have its web management interface accessible over the network (default HTTP/HTTPS ports 80/443). No special firmware configuration or non-default settings are indicated as necessary. The vulnerability exists in the default functionality of the device. The limiting factor is the PR:H (high privilege) requirement - unauthenticated remote exploitation is not possible without first obtaining admin credentials.

The raw CVSS score of 4.7 with AV:N/AC:L/PR:H indicates moderate severity, but this score reflects the high-privilege authentication requirement. The CVSS vector explicitly marks PR:H, meaning exploitation requires authenticated access with high-level privileges (typically admin credentials). However, the AC:L and AV:N components show the exploit is trivial to execute and requires no user interaction once authenticated. The public availability of exploit code (POC=YES) elevates practical risk. EPSS data is not provided, limiting probabilistic assessment. The conflict between moderate CVSS (4.7) and public exploit availability suggests this is a legitimate concern for environments where admin credential compromise is possible, but not a critical threat vector for typical network-segmented router deployments. Real-world risk depends heavily on authentication model: if admin credentials are shared, weak, or obtainable via phishing, risk escalates significantly. If admin access is tightly controlled and uses strong credentials, risk remains contained to insider or credential-compromise scenarios.

An authenticated administrator account on the Tenda AC6 device is either compromised via credential theft, phishing, or weak password, or an insider with admin credentials sends a crafted HTTP request to /goform/getLogFile with a malicious wans.flag parameter containing shell metacharacters and commands (e.g., wans.flag=1;cat%20/etc/passwd). The httpd daemon executes the injected command with the privileges of the web server process, allowing the attacker to read sensitive files, modify configuration, or establish reverse shell access.