A flaw exists in the httpd component of the Tenda AC6 firmware, accessed through the undocumented /goform/telnet endpoint. By manipulating the lan.ip parameter, an attacker can inject arbitrary operating‑system commands that are executed on the router. This allows complete compromise of the device, with the potential to read or modify configuration, create backdoors, or pivot into the local network, due to a command injection flaw classified as CWE-77 and CWE-78.

The vulnerable product is Tenda AC6. Firmware versions 2.0 and 15.03.06.23 are confirmed as affected. No other revisions are reported to be vulnerable.

The CVSS base score of 5.1 indicates a moderate impact on confidentiality, integrity, and availability. Because the exploit can be triggered router’s web interface, an attacker only needs access to the local network or Wi‑Fi to reach the vulnerable endpoint. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation is not yet documented. While the description does not detail authentication requirements, it is inferred that the telnet endpoint does not require prior authentication, allowing unauthenticated users with web access to trigger the injection.