# CVE-2026-8263: Tenda AC6 and AC10U OS command injection in fromSetWirelessRepeat

Source: https://junglewise.ai/threats/cve-2026-8263-tenda-ac6-and-ac10u-os-command-injection-in-fromsetwirelessrepeat  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-8263 · Severity: medium · CVSS 4.7 · Published 2026-05-11

A security vulnerability has been identified in Tenda AC6 and AC10U routers, which are devices used to provide wireless internet connectivity. An attacker can exploit this flaw to take control of the router remotely, potentially leading to unauthorized access to network traffic or a complete disruption of internet services. Because an exploit for this issue is publicly available, the risk of unauthorized parties attempting to compromise these devices is elevated.

Technologies: [Tenda AC6](https://junglewise.ai/threats/technologies/ac6). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-8263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8263 being exploited in the wild.

**How severe is CVE-2026-8263?** Medium severity, with a CVSS score of 4.7, published 11 May 2026.

**Which products and versions are affected?** Tenda AC10U 15.03.06.49_multi_TDE01; Tenda AC6 15.03.06.49_multi_TDE01.

**Is there a fix for CVE-2026-8263?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8263 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-8263?** Check whether you run Tenda AC10U, Tenda Ac10u Firmware or Tenda AC6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the 'fromSetWirelessRepeat' function within the '/goform/WifiExtraSet' (or '/goform/fromSetWirelessRepeat') endpoint of the Tenda AC6 and AC10U httpd component. The issue stems from improper neutralization of special elements in the 'mac', 'ssid', or 'wpapsk_crypto' parameters, leading to OS command injection and a stack-based buffer overflow via 'strcpy' without length validation. A remote attacker can exploit this by sending a specially crafted HTTP POST request to the device. Successful exploitation allows for arbitrary command execution with the privileges of the web server. While some sources suggest high privileges are required, others indicate the endpoint may be reachable without authentication; a public PoC has been released.

## Affected products

- Tenda AC6 15.03.06.49_multi_TDE01
- Tenda AC10U 15.03.06.49_multi_TDE01

## Timeline

- 2026-05-11: advisory: Initial disclosure by VulDB and NVD
- 2026-05-11: other: Public exploit released

## References

- [https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md](https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md)
- [https://vuldb.com/submit/810074](https://vuldb.com/submit/810074)
- [https://vuldb.com/vuln/362560](https://vuldb.com/vuln/362560)
- [https://vuldb.com/vuln/362560/cti](https://vuldb.com/vuln/362560/cti)
- [https://www.tenda.com.cn/](https://www.tenda.com.cn/)

## Related threats

- [Tenda AC6 OS command injection in get_log_file](https://junglewise.ai/threats/cve-2026-8265-tenda-ac6-os-command-injection-in-get-log-file)
- [Tenda AC6 OS command injection in formWifiApScan](https://junglewise.ai/threats/cve-2026-8264-tenda-ac6-os-command-injection-in-formwifiapscan)
- [Tenda AC6 OS command injection in /goform/telnet](https://junglewise.ai/threats/cve-2026-8259-tenda-ac6-os-command-injection-in-goform-telnet)
- [Tenda AC6 buffer overflow in formSetCfm](https://junglewise.ai/threats/cve-2025-52221-tenda-ac6-buffer-overflow-in-formsetcfm)
- [A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex…](https://junglewise.ai/threats/cve-2026-4961-a-vulnerability-was-identified-in-tenda-ac6-15-03-05-16-affected)