Is CVE-2026-8263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8263 being exploited in the wild.

How severe is CVE-2026-8263?

Medium severity, with a CVSS score of 4.7, published 11 May 2026.

Which products and versions are affected?

Tenda AC10U 15.03.06.49_multi_TDE01; Tenda AC6 15.03.06.49_multi_TDE01.

Is there a fix for CVE-2026-8263?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8263 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-8263?

Check whether you run Tenda AC10U, Tenda Ac10u Firmware or Tenda AC6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8263: Tenda AC6 and AC10U OS command injection in fromSetWirelessRepeat

CVE-2026-8263 · Severity: medium · CVSS 4.7 · Published 2026-05-11

A security vulnerability has been identified in Tenda AC6 and AC10U routers, which are devices used to provide wireless internet connectivity. An attacker can exploit this flaw to take control of the router remotely, potentially leading to unauthorized access to network traffic or a complete disruption of internet services. Because an exploit for this issue is publicly available, the risk of unauthorized parties attempting to compromise these devices is elevated.

Technologies: Tenda AC6. Vendors: Tenda.

Quick answers

Is CVE-2026-8263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8263 being exploited in the wild.
How severe is CVE-2026-8263?: Medium severity, with a CVSS score of 4.7, published 11 May 2026.
Which products and versions are affected?: Tenda AC10U 15.03.06.49_multi_TDE01; Tenda AC6 15.03.06.49_multi_TDE01.
Is there a fix for CVE-2026-8263?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8263 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-8263?: Check whether you run Tenda AC10U, Tenda Ac10u Firmware or Tenda AC6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the 'fromSetWirelessRepeat' function within the '/goform/WifiExtraSet' (or '/goform/fromSetWirelessRepeat') endpoint of the Tenda AC6 and AC10U httpd component. The issue stems from improper neutralization of special elements in the 'mac', 'ssid', or 'wpapsk_crypto' parameters, leading to OS command injection and a stack-based buffer overflow via 'strcpy' without length validation. A remote attacker can exploit this by sending a specially crafted HTTP POST request to the device. Successful exploitation allows for arbitrary command execution with the privileges of the web server. While some sources suggest high privileges are required, others indicate the endpoint may be reachable without authentication; a public PoC has been released.

Affected products

Tenda AC6 15.03.06.49_multi_TDE01
Tenda AC10U 15.03.06.49_multi_TDE01

Timeline

2026-05-11: advisory: Initial disclosure by VulDB and NVD
2026-05-11: other: Public exploit released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.