Executive brief
A security vulnerability has been found in the Tenda AC6 wireless router, a device used to provide Wi-Fi connectivity in homes and small offices. An attacker with basic access to the router's management interface can execute unauthorized commands on the device's operating system. This could allow a malicious actor to take full control of the router, potentially intercepting internet traffic or disrupting network services.
Technical details
An OS command injection vulnerability exists in the 'formWifiApScan' function (offset 0x4b1914) within the '/bin/httpd' binary of Tenda AC6 V2.0 firmware V15.03.06.23. The vulnerability is rooted in the improper neutralization of the 'wl2g.public.country' and 'wl5g.public.country' parameters. These values are retrieved via 'websGetVar()' and subsequently passed to 'doSystemCmd()'—which internally calls 'system()'—without any input sanitization. A remote attacker with authenticated access (PR:L) can exploit this by sending a specially crafted POST request to '/goform/WifiApScan' to execute arbitrary shell commands. A public exploit (PoC) is available.
Affected products
- Tenda AC6 (AC1206) 15.03.06.23
Timeline
- 2026-05-11: disclosed: Vulnerability disclosed and added to NVD/VulDB
- 2026-05-11: advisory