CVE-2026-8263: Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

Published May 11, 2026

Updated

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected Software

3 affected components

Tenda AC6=15.03.06.49_multi_TDE01

All of the following

Tenda Ac10u Firmware=15.03.06.49_multi_tde01

Tenda AC10U=1.0

Event History

May 11, 2026

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeaknessAffected Software

Feb 4, 58345

Event

via FIRST·03:00 AM

Frequently Asked Questions

What is the severity of CVE-2026-8263?

CVE-2026-8263 is categorized as a high severity vulnerability due to its potential for os command injection.

How do I fix CVE-2026-8263?

To fix CVE-2026-8263, users should upgrade their Tenda AC6 device to the latest firmware version provided by the manufacturer.

What systems are affected by CVE-2026-8263?

CVE-2026-8263 specifically affects Tenda AC6 devices running firmware version 15.03.06.49_multi_TDE01.

What could an attacker do by exploiting CVE-2026-8263?

An attacker exploiting CVE-2026-8263 could execute arbitrary commands on the affected Tenda AC6 device.

Is there a workaround for CVE-2026-8263?

Currently, there is no official workaround for CVE-2026-8263, and updating the firmware is the recommended action.

CVSS Score

4.7Medium

Medium Severity

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Security Metrics

Risk Score61

Severitylow(2)

EPSS0.346%

CWE

7877787

Timeline

PublishedMay 11, 2026

Updated

References

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.