ByteOS Network

CVE Vulnerability Details :

CVE-2026-8263

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-11 May, 2026 | 02:00

Updated At-11 May, 2026 | 02:00

▼CVE Numbering Authority (CNA)

Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected Products

Vendor

Tenda Technology Co., Ltd.

Product

AC6

CPEs

cpe:2.3:o:tenda:ac6_firmware:*:*:*:*:*:*:*:*

Modules

httpd

Versions

Affected

15.03.06.49_multi_TDE01

Problem Types

Type	CWE ID	Description
CWE	CWE-78	OS Command Injection
CWE	CWE-77	Command Injection

Type: CWE

CWE ID: CWE-78

Description: OS Command Injection

Type: CWE

CWE ID: CWE-77

Description: Command Injection

Metrics

Version	Base score	Base severity	Vector
4.0	5.1	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3.0	4.7	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2.0	5.8	N/A	AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 5.1

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 4.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 3.0

Base score: 4.7

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 2.0

Base score: 5.8

Base severity: N/A

Vector:

AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Credits

reporter

ST4R (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-05-10 00:00:00
VulDB entry created	2026-05-10 02:00:00
VulDB entry last update	2026-05-10 17:40:47

Event: Advisory disclosed

Date: 2026-05-10 00:00:00

Event: VulDB entry created

Date: 2026-05-10 02:00:00

Event: VulDB entry last update

Date: 2026-05-10 17:40:47

References

Hyperlink	Resource
https://vuldb.com/vuln/362560	vdb-entry technical-description
https://vuldb.com/vuln/362560/cti	signature permissions-required
https://vuldb.com/submit/810074	third-party-advisory
https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md	exploit
https://www.tenda.com.cn/	product