Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-8263 A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the compone… https://www.cve.org/CVERecord?id=CVE-2026-8263
Post summary
A CVE was announced for Tenda AC6 firmware, detailing the affected function and file, but no exploit, patch, or active use is reported.
CVE-2026-8263 Remote OS Command Injection in Tenda AC6 15.03.06.49_multi_TDE01 WifiExtraSet https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8263
Post summary
A new CVE-2026-8263 highlights a remote OS command injection flaw in Tenda AC6 firmware, with the available information limited to a vulnerability overview and no evidence of a PoC, active exploitation, or patch availability.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tenda | ac10u | 1.0 | - | - |
| OS | tenda | ac10u_firmware | 15.03.06.49_multi_tde01 | - | - |