CVE-2026-8263

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-826307.3A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file power CVE-2026-826312.2A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file sr CVE-2026-826323.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-826334.3Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing a CVE-2026-826346.5Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to CVE-2026-826358.8Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sa CVE-2026-826367.9Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qu CVE-2026-826375.3browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create dire CVE-2026-826387.5jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-sid CVE-2026-826397.5NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to CVE-2026-82648.8A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/W CVE-2026-826405.5browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions