# CVE-2026-8259: Tenda AC6 OS command injection in /goform/telnet

Source: https://junglewise.ai/threats/cve-2026-8259-tenda-ac6-os-command-injection-in-goform-telnet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-8259 · Severity: medium · CVSS 4.7 · Published 2026-05-11

A vulnerability exists in the Tenda AC6 wireless router, a device used to provide Wi-Fi connectivity in homes and small offices. An attacker with administrative access can exploit this flaw to execute unauthorized system commands on the router. This could lead to a complete takeover of the device, allowing the attacker to intercept network traffic, change security settings, or use the router as a foothold for further attacks on the local network.

Technologies: [Tenda AC6](https://junglewise.ai/threats/technologies/ac6), [Tenda Ac6 Firmware](https://junglewise.ai/threats/technologies/ac6-firmware). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-8259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8259 being exploited in the wild.

**How severe is CVE-2026-8259?** Medium severity, with a CVSS score of 4.7, published 11 May 2026.

**Which products and versions are affected?** Tenda AC6 2.0/15.03.06.23.

**Is there a fix for CVE-2026-8259?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8259 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-8259?** Check whether you run Tenda AC6 or Tenda Ac6 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the TendaTelnet handler (0x45b860) within the /bin/httpd binary of Tenda AC6 V2.0 firmware V15.03.06.23. The application fails to sanitize the 'lan.ip' parameter received via the /goform/telnet endpoint before passing it to a system() call via doSystemCmd(). Specifically, the input is formatted into a 'telnetd -b %s &' string, allowing an attacker to use shell metacharacters (e.g., semicolons) to execute arbitrary commands. While remote exploitation is possible, it requires high privileges (administrative session) to access the vulnerable web form. A public proof-of-concept exists demonstrating the ability to read sensitive files like /etc/passwd.

## Affected products

- Tenda AC6 2.0/15.03.06.23

## Timeline

- 2026-05-11: disclosed: Initial disclosure and NVD publication
- 2026-05-11: advisory

## References

- [https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20TendaTelnet%20Command%20Injection.md](https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20TendaTelnet%20Command%20Injection.md)
- [https://vuldb.com/submit/809877](https://vuldb.com/submit/809877)
- [https://vuldb.com/vuln/362556](https://vuldb.com/vuln/362556)
- [https://vuldb.com/vuln/362556/cti](https://vuldb.com/vuln/362556/cti)
- [https://www.tenda.com.cn/](https://www.tenda.com.cn/)

## Related threats

- [Tenda Firmware authentication backdoor in httpd login function](https://junglewise.ai/threats/cve-2026-11405-tenda-firmware-authentication-backdoor-in-httpd-login-function)
- [Tenda AC6 OS command injection in get_log_file](https://junglewise.ai/threats/cve-2026-8265-tenda-ac6-os-command-injection-in-get-log-file)
- [Tenda AC6 OS command injection in formWifiApScan](https://junglewise.ai/threats/cve-2026-8264-tenda-ac6-os-command-injection-in-formwifiapscan)
- [Tenda AC6 and AC10U OS command injection in fromSetWirelessRepeat](https://junglewise.ai/threats/cve-2026-8263-tenda-ac6-and-ac10u-os-command-injection-in-fromsetwirelessrepeat)
- [Tenda AC6 buffer overflow in formSetCfm](https://junglewise.ai/threats/cve-2025-52221-tenda-ac6-buffer-overflow-in-formsetcfm)