CVE-2026-8263mediumCWE-77CWE-78

CVE-2026-8263: medium-severity vulnerability in Tenda AC6

Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

Published

Follow this CVE+ Monitor AC6

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 5.0%
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · AC6
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Tenda AC6

In the same product, most dangerous first.

CVE-2024-10697MEDIUMTenda AC6 API Endpoint WriteFacMac formWriteFacMac command injectionEPSS 26.2%CVE-2025-5853HIGHTenda AC6 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflowEPSS 7.8%CVE-2026-8259MEDIUMTenda AC6 httpd telnet os command injectionEPSS 4.9%CVE-2026-8265MEDIUMTenda AC6 httpd getLogFile get_log_file os command injectionEPSS 4.8%CVE-2026-8264MEDIUMTenda AC6 httpd WifiApScan formWifiApScan os command injectionEPSS 3.2%CVE-2025-0349HIGHTenda AC6 GetParentControlInfo stack-based overflowEPSS 1.9%