CVE-2026-0581

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-77

Affected software

VendorProductVersions
TendaAC120615.03.06.23

References

Timeline

Published
Jan 5, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-05829.8A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_activity_CVE-2026-05839.8A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This vulnerability affects unknown code of the fCVE-2026-05849.8A weakness has been identified in code-projects Online Product Reservation System 1.0. This issue affects some unknown processing of the filCVE-2026-05859.8A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the fiCVE-2026-05866.1A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the fileCVE-2026-05875.4A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of CVE-2026-05886.1A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file CVE-2026-05897.3A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component AdministrCVE-2026-05909.8A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the fiCVE-2026-05919.8A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the fiCVE-2026-05929.8A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This affects an unknown function of the file /haCVE-2026-05935.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability
CVE-2026-0581: Critical severity, CVSS 9.8 | Vulnix