Vulnerability Description
A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Ac6 Firmware | 15.03.06.23 |
| Tenda | Ac6 | 2.0 |
Related Weaknesses (CWE)
References
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/ExploitThird Party Advisory
- https://vuldb.com/submit/810075Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/362561Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/362561/ctiPermissions RequiredVDB Entry
- https://www.tenda.com.cn/Product
FAQ
What is CVE-2026-8264?
CVE-2026-8264 is a vulnerability with a CVSS score of 6.3 (MEDIUM). A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation o...
How severe is CVE-2026-8264?
CVE-2026-8264 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8264?
Check the references section above for vendor advisories and patch information. Affected products include: Tenda Ac6 Firmware, Tenda Ac6.