PT-2026-39562 · Tenda · Ac6

St4R · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-8263

NVD

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

A security flaw has been discovered in Tenda AC6 15.03.06.49 multi TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-8263

Affected Products

Ac6

References · 6

• 🔥 https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8263 · Security Note
• https://vuldb.com/submit/810074 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/vuln/362560 · Note
• https://vuldb.com/vuln/362560/cti · Note