Description
A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RAV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:URExploitation Context
as of October 15, 2026- Its current EPSS score (9.4%) is higher than that of 25% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Tenda | Tenda AC1206 | 15.03.06.23 |
References
5 LinksRecord Details
More from Tenda
Tenda AC11 Router Stack Buffer Overflow Vulnerability
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Tenda G103 Setting gpon.lua action_set_net_settings command injection
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.