# CVE-2026-8265: Tenda AC6 OS command injection in get_log_file

Source: https://junglewise.ai/threats/cve-2026-8265-tenda-ac6-os-command-injection-in-get-log-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-8265 · Severity: medium · CVSS 4.7 · Published 2026-05-11

A security vulnerability exists in the Tenda AC6 wireless router, a device used to provide Wi-Fi connectivity in homes and small offices. An attacker with administrative access can exploit this flaw to run unauthorized system commands on the router. This could lead to a complete takeover of the device, allowing the attacker to monitor network traffic, disrupt internet service, or use the router as a foothold for further attacks on the local network.

Technologies: [Tenda AC6](https://junglewise.ai/threats/technologies/ac6), [Tenda Ac6 Firmware](https://junglewise.ai/threats/technologies/ac6-firmware). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-8265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8265 being exploited in the wild.

**How severe is CVE-2026-8265?** Medium severity, with a CVSS score of 4.7, published 11 May 2026.

**Which products and versions are affected?** Tenda AC6 15.03.06.23.

**Is there a fix for CVE-2026-8265?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8265 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-8265?** Check whether you run Tenda AC6 or Tenda Ac6 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the 'get_log_file' function (offset 0x4462d0) within the '/bin/httpd' binary of Tenda AC6 V2.0 (AC1206) firmware version 15.03.06.23. The vulnerability is located in the handling of the '/goform/getLogFile' endpoint. The application retrieves the 'wans.flag' POST parameter using 'websGetVar()' and improperly incorporates it into a system call via 'doSystemCmd()' using a format string like 'echo "%s:" >> <logfile>'. An attacker can escape the double-quote context using shell metacharacters (e.g., '";id;"') to execute arbitrary OS commands. While the attack is reachable over the network, it requires high privileges (valid administrative session).

## Affected products

- Tenda AC6 (AC1206) 15.03.06.23

## Timeline

- 2026-05-11: disclosed: Public disclosure of the vulnerability and PoC
- 2026-05-11: advisory: NVD publication date

## References

- [https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.md](https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.md)
- [https://vuldb.com/submit/810076](https://vuldb.com/submit/810076)
- [https://vuldb.com/vuln/362562](https://vuldb.com/vuln/362562)
- [https://vuldb.com/vuln/362562/cti](https://vuldb.com/vuln/362562/cti)
- [https://www.tenda.com.cn/](https://www.tenda.com.cn/)

## Related threats

- [Tenda Firmware authentication backdoor in httpd login function](https://junglewise.ai/threats/cve-2026-11405-tenda-firmware-authentication-backdoor-in-httpd-login-function)
- [Tenda AC6 OS command injection in formWifiApScan](https://junglewise.ai/threats/cve-2026-8264-tenda-ac6-os-command-injection-in-formwifiapscan)
- [Tenda AC6 and AC10U OS command injection in fromSetWirelessRepeat](https://junglewise.ai/threats/cve-2026-8263-tenda-ac6-and-ac10u-os-command-injection-in-fromsetwirelessrepeat)
- [Tenda AC6 OS command injection in /goform/telnet](https://junglewise.ai/threats/cve-2026-8259-tenda-ac6-os-command-injection-in-goform-telnet)
- [Tenda AC6 buffer overflow in formSetCfm](https://junglewise.ai/threats/cve-2025-52221-tenda-ac6-buffer-overflow-in-formsetcfm)