CVE-2026-8265: Tenda AC6 Firmware RCE Vulnerability

CVE-2026-8265 Overview

CVE-2026-8265 is an OS command injection vulnerability affecting Tenda AC6 routers running firmware version 15.03.06.23. The flaw resides in the get_log_file function within /goform/getLogFile, a handler exposed by the device's httpd component. Attackers manipulate the wans.flag argument to inject arbitrary operating system commands into the underlying shell. The issue is classified under [CWE-77] (Command Injection) and [CWE-78] (OS Command Injection). Exploitation requires network access and high privileges on the device, but the vulnerability can be triggered remotely. The exploit details have been publicly disclosed.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected Tenda AC6 routers, leading to compromise of the device and the network it serves.

Affected Products

Tenda AC6 hardware version 2.0
Tenda AC6 firmware 15.03.06.23
httpd component handling /goform/getLogFile

Discovery Timeline

2026-05-11 - CVE-2026-8265 published to NVD
2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8265

Vulnerability Analysis

The vulnerability exists in the get_log_file function exposed through the /goform/getLogFile endpoint on the Tenda AC6 router's embedded web server. The handler accepts a wans.flag parameter from HTTP requests and incorporates the value into a shell command without proper sanitization or validation. An attacker who can reach the management interface and authenticate can submit a crafted wans.flag value containing shell metacharacters, causing the device to execute attacker-supplied commands in the context of the httpd process. On consumer routers, this process typically runs with root privileges, granting full control over the device.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The get_log_file routine concatenates user-controlled input into a command string passed to a shell interpreter without escaping or whitelisting allowed values. This pattern is common in embedded router firmware where developers rely on system() or similar calls to invoke utilities such as cat, tar, or log collection scripts.

Attack Vector

The attack vector is network-based. The attacker sends an HTTP request to /goform/getLogFile with a malicious wans.flag parameter. Authentication is required, raising the bar for exploitation, but credentials are often weak, reused, or default on consumer hardware. Successful exploitation yields command execution on the router, enabling persistence, traffic interception, lateral movement, or recruitment into botnets.

No verified proof-of-concept code is reproduced here. Technical details and a public write-up are available in the GitHub PoC Repository and the corresponding VulDB #362562 entry.

Detection Methods for CVE-2026-8265

Indicators of Compromise

HTTP requests to /goform/getLogFile containing shell metacharacters such as ;, |, &, backticks, or $() within the wans.flag parameter.
Unexpected outbound connections from the router to unfamiliar IP addresses shortly after administrative requests.
New or modified files in writable router directories such as /tmp or /var, or unexplained processes spawned by httpd.

Detection Strategies

Inspect router access logs and any upstream proxy or WAF logs for POST or GET requests to /goform/getLogFile with suspicious parameter values.
Deploy network intrusion detection signatures that flag command injection payload patterns targeting Tenda goform endpoints.
Monitor for management interface exposure on WAN-facing interfaces, which significantly increases the attack surface for this issue.

Monitoring Recommendations

Centralize router syslog output and alert on unusual administrative activity, failed logins, and configuration changes.
Baseline normal traffic from router management IPs and alert on deviations such as crypto-mining or scanning behavior.
Track firmware version inventory for Tenda AC6 devices and flag any unit still running 15.03.06.23.

How to Mitigate CVE-2026-8265

Immediate Actions Required

Disable remote (WAN) management on all Tenda AC6 routers and restrict the web interface to trusted LAN segments only.
Rotate administrative credentials and enforce strong, unique passwords on every affected device.
Segment router management interfaces away from user and IoT VLANs to limit who can reach /goform/getLogFile.

Patch Information

At the time of publication, no vendor advisory or firmware update addressing CVE-2026-8265 has been published. Check the Tenda Official Website for updates and apply any firmware release that supersedes 15.03.06.23 as soon as it becomes available.

Workarounds

Place affected routers behind a firewall that filters HTTP requests to /goform/getLogFile until a vendor patch is released.
Replace end-of-support or unpatched Tenda AC6 units with hardware that receives active security maintenance.
Where feasible, deploy an upstream reverse proxy or WAF rule that rejects requests containing shell metacharacters in the wans.flag parameter.

bash

# Example WAF/iptables-style rule concept to drop suspicious requests
# targeting the vulnerable endpoint until a vendor patch is applied.
iptables -I FORWARD -p tcp --dport 80 -m string \
  --algo bm --string "/goform/getLogFile" -j LOG --log-prefix "TENDA-AC6-CVE-2026-8265 "
iptables -I FORWARD -p tcp --dport 80 -m string \
  --algo bm --string "wans.flag=" -j DROP