This vulnerability affects the Tenda AC10 router firmware 16.03.10.10_multi_TDE01. The issue is an OS command injection in the formAddMacfilterRule function of the /bin/httpd executable. An attacker can remotely exploit this flaw to execute arbitrary OS commands on the device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor.

Successful exploitation could allow a remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact is rated medium based on the CVSS score of 5.3, reflecting limited but meaningful risk due to the ability to execute commands remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity. No vendor-provided mitigation or workaround is currently available.