CVE-2026-8263

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

• CWE-77
• CWE-78
• CWE-787

• https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.mdExploit, Third Party Advisory
• https://vuldb.com/submit/810074Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/362560Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/362560/ctiPermissions Required, VDB Entry
• https://www.tenda.com.cn/Product

Published

May 11, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82622A security vulnerability has been detected in code-projects …3.5
• CVE-2026-82623A vulnerability was detected in open62541 up to 1.5.5. Affec…5.3
• CVE-2026-82624A flaw has been found in code-projects Simple Inventory Syst…5.3
• CVE-2026-82625A vulnerability has been found in code-projects Simple Inven…4.3
• CVE-2026-82628A vulnerability was found in Colorful iGameCenter 2.0.0.81. …8.8
• CVE-2026-82629A vulnerability was determined in jeecgboot jeewx-boot up to…4.7
• CVE-2026-82630A vulnerability was identified in PowerJob up to 5.1.2. Impa…7.3
• CVE-2026-82631A security flaw has been discovered in valkey-io valkey 9.1.…2.2
• CVE-2026-82633Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-o…4.3
• CVE-2026-82634Frappe Framework development builds contain an authorization…6.5
• CVE-2026-82635Pake before 3.13.1 joins the JavaScript-supplied filename fo…8.8
• CVE-2026-82636Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS comma…7.9