The vulnerability of the httpd component of the formBehaviorManager function in the Tenda AC1206 router microprogramming system allows a attacker to execute arbitrary commands.

The vulnerability of the httpd component of the formBehaviorManager function in the Tenda AC1206 router microprogramming system is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability may allow an attacker to execute arbitrary commands remotely...

VulnCheck KEV: CVE-2025-7544

A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. Th...

CVE-2022-42081

Tenda AC1206 USAC1206V1.0RTLV15.03.06.23multiTD01 was discovered to contain a stack overflow via schedendtime parameter...

CVE-2022-42077

Tenda AC1206 USAC1206V1.0RTLV15.03.06.23multiTD01 is vulnerable to Cross Site Request Forgery CSRF via function fromSysToolReboot...

CVE-2022-42079

Tenda AC1206 USAC1206V1.0RTLV15.03.06.23multiTD01 was discovered to contain a stack overflow via the function formWifiBasicSet...

CVE-2022-37814

Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the deviceid parameters in the function addWifiMacFilter...

CVE-2022-37805

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromWizardHandle...

CVE-2022-37810

Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac...

CVE-2022-37799

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement...

CVE-2022-37809

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the speeddir parameter in the function formSetSpeedWan...

CVE-2022-37801

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand...

CVE-2022-37806

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromDhcpListClient...

CVE-2022-37815

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the PPPOEPassword parameter in the function formQuickIndex...

CVE-2022-37802

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromNatStaticSetting...

CVE-2022-37811

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the startIp parameter in the function formSetPPTPServer...

CVE-2026-0581

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can b...

CVE-2026-0581

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can b...

CVE-2026-0581

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can b...

CVE-2026-0581 Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can b...

CVE-2026-0581

CVE-2026-0581 affects Tenda AC1206 (firmware 15.03.06.23) with a vulnerable httpd component. The bug resides in the formBehaviorManager function in /goform/BehaviorManager, where manipulating the modulename/option/data/switch arguments can trigger a remote command injection. Multiple connected so...