CVE-2026-4253
MEDIUMTenda AC8 Web UploadCfg route_set_user_policy_rule os command injection
Title source: cnaDescription
A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Scores
CVSS v3
4.7
EPSS
0.0037
EPSS Percentile
58.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-78
CWE-77
Status
published
Products (2)
Tenda/AC8
16.03.50.11
tenda/ac8_firmware
16.03.50.11
Published
Mar 16, 2026
Tracked Since
Mar 16, 2026