CVE-2026-4253

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-425308.1NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, CVE-2026-425325.5A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A speciCVE-2026-425338.1A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the mCVE-2026-425345.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resoCVE-2026-425359.1A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property CVE-2026-425367.5Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects ACVE-2026-425379.8Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this iCVE-2026-425386.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425396.5IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-42549.8A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToCVE-2026-425404.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425414.3Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissi