CVE-2026-4253

MEDIUM

Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-4253. PoCs published by renzi25031469.

AI-analyzed exploit summary This repository contains a non-destructive scanner for CVE-2026-42530, a use-after-free vulnerability in NGINX's HTTP/3 (QUIC) module. The scanner probes targets via HTTP/3 to detect vulnerable NGINX versions (1.31.0 and 1.31.1) without triggering the exploit.

Description

A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Exploits (1)

nomisec SCANNER
by renzi25031469 · poc
https://github.com/renzi25031469/CVE-2026-4253-Scanner

This repository contains a non-destructive scanner for CVE-2026-42530, a use-after-free vulnerability in NGINX's HTTP/3 (QUIC) module. The scanner probes targets via HTTP/3 to detect vulnerable NGINX versions (1.31.0 and 1.31.1) without triggering the exploit.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: NGINX Open Source 1.31.0-1.31.1 with HTTP/3 enabled
No auth needed
Prerequisites: HTTP/3 (QUIC) must be enabled on the target NGINX server
mistral-large-3 · analyzed Jun 25, 2026 Full analysis →

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-351211 | Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection
https://vuldb.com/?id.351211
Signature, Permissions Required signature permissions-required
VDB-351211 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/?ctiid.351211
Third Party Advisory third-party-advisory
Submit #771771 | Tenda AC8 V5 V16.03.50.11 OS Command Injection
https://vuldb.com/?submit.771771
Product product
https://www.tenda.com.cn/

Scores

CVSS v3 4.7
EPSS 0.0635
EPSS Percentile 92.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (2)
Tenda/AC8 16.03.50.11
tenda/ac8_firmware 16.03.50.11
Published Mar 16, 2026
Tracked Since Mar 16, 2026