PT-2026-1228 · Tenda · Tenda Ac1206

2160288544 · Publicado 2026-01-04 · Atualizado 2026-01-05 · CVE-2026-0581

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23

Description A remote command injection issue exists in the formBehaviorManager function within the /goform/BehaviorManager file of the httpd component. Manipulation of the modulename/option/data/switch argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /goform/BehaviorManager file. Avoid using the modulename, option, data, and switch parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2026-02030

CVE-2026-0581

Produtos afetados

Tenda Ac1206

Referências · 12

• 🔥 https://github.com/ccc-iotsec/cve-/blob/Tenda/Tenda%20AC1206%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md · Exploit
• 🔥 https://github.com/ccc-iotsec/cve-/blob/Tenda/Tenda%20AC1206.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0581 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2008125966099288443 · Publicação no Twitter
• https://t.me/cveNotify/147695 · Publicação no Telegram
• https://vuldb.com/?id.339473 · Nota
• https://vuldb.com/?ctiid.339473 · Nota
• https://twitter.com/CVEnew/status/2008100443759468991 · Publicação no Twitter
• https://vuldb.com/?submit.731193 · Nota
• https://tenda.com.cn · Nota
• https://osv.dev/vulnerability/CVE-2026-0581 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-02030 · Nota de Segurança