Vulnerability Description
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Ac6 Firmware | 15.03.06.23 |
| Tenda | Ac6 | 2.0 |
Related Weaknesses (CWE)
References
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/ExploitThird Party Advisory
- https://vuldb.com/submit/809877Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/362556Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/362556/ctiPermissions RequiredVDB Entry
- https://www.tenda.com.cn/Product
FAQ
What is CVE-2026-8259?
CVE-2026-8259 is a vulnerability with a CVSS score of 4.7 (MEDIUM). A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip lead...
How severe is CVE-2026-8259?
CVE-2026-8259 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8259?
Check the references section above for vendor advisories and patch information. Affected products include: Tenda Ac6 Firmware, Tenda Ac6.