A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.md | Exploit Third Party Advisory |
| https://vuldb.com/submit/810076 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/362562 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/362562/cti | Permissions Required VDB Entry |
| https://www.tenda.com.cn/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
11 May 2026, 17:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/submit/810076 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/362562 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/362562/cti - Permissions Required, VDB Entry | |
| References | () https://www.tenda.com.cn/ - Product | |
| First Time |
Tenda ac6
Tenda ac6 Firmware Tenda |
|
| CPE | cpe:2.3:h:tenda:ac6:2.0:*:*:*:*:*:*:* cpe:2.3:o:tenda:ac6_firmware:15.03.06.23:*:*:*:*:*:*:* |
11 May 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-11 04:16
Updated : 2026-05-11 17:03
NVD link : CVE-2026-8265
Mitre link : CVE-2026-8265
CVE.ORG link : CVE-2026-8265
JSON object : View
Products Affected
tenda
- ac6_firmware
- ac6