A flaw exists in the httpd component of the Tenda AC6 firmware, accessed through the undocumented /goform/telnet endpoint. By manipulating the lan.ip parameter, an attacker can inject arbitrary operating‑system commands that are executed on the router. This allows complete compromise of the device, with the potential to read or modify configuration, create backdoors, or pivot into the local network, due to a command injection flaw classified as CWE-77 and CWE-78.

The vulnerable product is Tenda AC6. Firmware versions 2.0 and 15.03.06.23 are confirmed as affected. No other revisions are reported to be vulnerable.

The CVSS base score of 5.1 indicates a moderate impact on confidentiality, integrity, and availability. Because the exploit can be triggered from the router’s web interface, an attacker only needs access to that interface, which may be reachable remotely, to reach the vulnerable endpoint. The EPSS score of 4% indicates a moderate probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation is not yet documented. While the description does not detail authentication requirements, it is inferred that the telnet endpoint does not require prior authentication, allowing unauthenticated users with web access to trigger the injection.