This vulnerability involves an OS command injection in the Tenda AC10 router firmware 16.03.10.10_multi_TDE01. Specifically, the formAddMacfilterRule function in /bin/httpd improperly handles input, enabling remote attackers to inject and execute arbitrary operating system commands. The issue affects multiple endpoints on the device, potentially allowing unauthorized command execution remotely without user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on affected Tenda AC10 devices, potentially leading to unauthorized control or disruption of the device. The impact is rated medium severity based on CVSS 4.0 scoring. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the device's management interface and monitor for unusual activity. No vendor advisory or official patch information is currently available.