VulnerabilityAnalyzed

CVE-2026-8265

A security vulnerability has been detected in Tenda AC6 15.03.06.23.

LOW 2.0EPSS 4.41%

Does this matter?

Lower severity and a low EPSS score (4.41%). Track it; it rarely justifies an emergency change on its own.

Description

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0: 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 4.41% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-77, CWE-78
Affected: tenda/ac6 firmware
Source: cna@vuldb.com

References

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.mdExploit, Third Party Advisory
https://vuldb.com/submit/810076Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362562Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362562/ctiPermissions Required, VDB Entry
https://www.tenda.com.cn/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.