CVE-2026-8265

published 2026-05-11

CVE-2026-8265: A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the…

low 2 CVSS 4.0

AV N AC L AT N PR H UI N VC L VI L VA L SC N SI N SA N E P CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tenda	ac6	—	—
tenda	ac6_firmware	—	—

CWE-77 CWE-78 CWE-22