CVE-2026-8263: Tenda AC6 Wi-Fi Settings Can Be Hijacked Remotely

Summary

The Tenda AC6 Wi-Fi router has a security flaw that allows an attacker to remotely take control of its Wi-Fi settings. This could be used to disrupt or hijack the router's Wi-Fi connection. Tenda should be contacted for a software update to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
tenda	ac10u_firmware	15.03.06.49_multi_tde01 `cpe:2.3:o:tenda:ac10u_firmware:15.03.06.49_multi_tde01:::::::*`

Original title

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipu...

Original description

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

nvd CVSS2.0 5.8

nvd CVSS3.1 4.7

nvd CVSS4.0 2.0

Vulnerability type

CWE-77 Command Injection

CWE-78 OS Command Injection

CWE-787 Out-of-bounds Write