The vulnerability CVE-2026-8263 affects Tenda AC6 routers running firmware version 15.03.06.49_multi_TDE01. It is an OS command injection flaw in the fromSetWirelessRepeat function of the /goform/WifiExtraSet endpoint in the httpd component. By manipulating the mac or ssid arguments, a remote attacker can inject and execute arbitrary operating system commands. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or vendor remediation level has been published, and the device is not a cloud service. Public exploit code is available, but there are no confirmed reports of exploitation in the wild.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the router. Given the medium CVSS score and the nature of command injection, the impact could include device compromise or network disruption. However, no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor Tenda's official channels for updates. Until a patch is available, restricting remote access to the router's management interface and disabling remote administration features, if possible, may reduce exposure.