A flaw in the Tenda AC8 router’s web interface allows an attacker to manipulate the wans.policy.list1 argument of the /cgi-bin/UploadCfg endpoint. The manipulation triggers an operating‑system command injection, which falls under CWE‑77 and CWE‑78 weaknesses. As a result, an attacker can execute arbitrary commands on the device, potentially leading to full system compromise.

The vulnerability is confirmed in Tenda AC8 model firmware version 16.03.50.11, as referenced in the CPE list cpe:2.3:o:tenda:ac8_firmware:16.03.50.11.*. The CPE data also lists the generic Tenda AC8 5.0 product line, but only the 16.03.50.11 build is known to be affected per the provided description.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score is below 1 %, and the issue is not in the CISA KEV catalog. The official description states that the attack can be launched remotely without authentication, and public proof‑of‑concept code is available, suggesting that exploitation is feasible and could occur from external networks. Based on the description, it is inferred that successful exploitation may grant an attacker complete control over the device’s configuration and operations.