PT-2026-1228 · Tenda · Tenda Ac1206

2160288544 · Published 2026-01-04 · Updated 2026-01-05 · CVE-2026-0581

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23

Description A remote command injection issue exists in the formBehaviorManager function within the /goform/BehaviorManager file of the httpd component. Manipulation of the modulename/option/data/switch argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /goform/BehaviorManager file. Avoid using the modulename, option, data, and switch parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2026-02030

CVE-2026-0581

Affected Products

Tenda Ac1206

References · 12

• 🔥 https://github.com/ccc-iotsec/cve-/blob/Tenda/Tenda%20AC1206%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md · Exploit
• 🔥 https://github.com/ccc-iotsec/cve-/blob/Tenda/Tenda%20AC1206.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0581 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0581 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02030 · Security Note
• https://twitter.com/VulmonFeeds/status/2008125966099288443 · Twitter Post
• https://t.me/cveNotify/147695 · Telegram Post
• https://vuldb.com/?id.339473 · Note
• https://vuldb.com/?ctiid.339473 · Note
• https://twitter.com/CVEnew/status/2008100443759468991 · Twitter Post
• https://vuldb.com/?submit.731193 · Note
• https://tenda.com.cn · Note