CVE-2026-0581

CWE-74CWE-77 — Command Injection3 documents3 sources
Severity
5.3MEDIUM
EPSS
1.2%
top 21.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tenda Ac1206Tenda Ac1206 Firmware
Timeline
PublishedJan 5

Description

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5tenda/ac120615.03.06.23
▶NVDtenda/ac1206_firmware15.03.06.23

🔴Vulnerability Details

2
CVEList
Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection↗2026-01-05
▶
GHSA
GHSA-fr39-x6rf-54c7: A vulnerability was determined in Tenda AC1206 15↗2026-01-05
▶