A vulnerability has been identified in the Tenda AC1206 router firmware 15.03.06.23. The affected component is the httpd endpoint /goform/BehaviorManager, where the function formBehaviorManager parses the arguments modulename, option, data, and switch. Improper input validation allows an attacker to inject operating‑system commands, granting remote execution privileges. The flaw corresponds to CWE‑74 (Improper Neutralization of Special Elements used in a Command) and CWE‑77 (Command Injection).

Tenda AC1206 routers running firmware version 15.03.06.23 are affected. The vulnerability is present in the httpd component and may impact all devices that expose the vulnerable endpoint, including those accessed via the web interface.

The severity is moderate with a CVSS score of 5.3, and the EPSS indicates a 1 % likelihood of exploitation. The vulnerability is attackable remotely through the web interface and has already been publicly disclosed, though it is not yet listed in the CISA KEV catalog. Attackers do not need user credentials to trigger the exploit if authentication is weak or bypassed; however, the exact authentication requirements are not detailed in the description. The overall risk is sufficient to warrant prompt remediation.