CVE-2026-8265

🗓️ 11 May 2026 02:30:14Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

Tenda AC6 remote OS command injection via getLogFile wans.flag.

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2026-8265	11 May 202602:30	–	attackerkb
BDU FSTEC	Tenda AC6 Router Code Execution	13 May 202600:00	–	bdu_fstec
Circl	CVE-2026-8265	11 May 202606:53	–	circl
CNNVD	Tenda AC6 command injection vulnerability	11 May 202600:00	–	cnnvd
CNVD	Tenda AC6 operating system command injection vulnerability	12 May 202600:00	–	cnvd
Cvelist	CVE-2026-8265 Tenda AC6 httpd getLogFile get_log_file os command injection	11 May 202602:30	–	cvelist
EUVD	EUVD-2026-29022	11 May 202606:31	–	euvd
NVD	CVE-2026-8265	11 May 202604:16	–	nvd
Positive Technologies	PT-2026-39564	11 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-8265: Improper Neutralization of Special Elements used in an OS Command	11 May 202600:00	–	rapid7

NVD

Vulners

Node

AND

tenda ac6_firmwareMatch15.03.06.23

tenda ac6Match2.0

[
  {
    "vendor": "Tenda",
    "product": "AC6",
    "versions": [
      {
        "version": "15.03.06.23",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:tenda:ac6_firmware:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "httpd"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/362562
vuldb	www.vuldb.com/vuln/362562/cti
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/submit/810076
github	www.github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Tenda%20AC6V2%20get_log_file%20Command%20Injection%20via%20wans.flag.md

Parameter	Position	Path	Description	CWE
wans.flag	query param	/goform/getLogFile	OS command injection via wans.flag parameter in /goform/getLogFile (Tenda AC6). Remote exploit disclosed.	CWE-77, CWE-78

23 Jul 2026 20:10Current

6Medium risk

Vulners AI Score6

CVSS 3.14.7 - 7.2

CVSS 34.7

CVSS 45.1

CVSS 25.8

EPSS0.08314

SSVC