A flaw in the Tenda AC6 firmware 15.03.06.49_multi_TDE01 allows an attacker to manipulate the mac or ssid parameters in the /goform/WifiExtraSet endpoint, resulting in OS command injection. Additionally, the handling of these parameters can lead to a buffer overflow (CWE-787), potentially enabling memory corruption and increasing the impact. An exploitation of this weakness can execute arbitrary commands on the device, potentially providing full control over the router. The weakness falls under CWE‑77, CWE‑78, and CWE‑787, indicating that unsanitized command line arguments are being passed to the operating system and that buffer misuse could occur.

The affected product is the Tenda AC6 Wi‑Fi router running firmware version 15.03.06.49_multi_TDE01. No other vendors or products are listed in the CVE data.

The CVSS score of 5.1 classifies the issue as medium severity. EPSS score of 0.00561 indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable remotely via the web interface, and an exploit has already been publicly released, increasing the likelihood that resourceful adversaries may target vulnerable devices. The presence of a buffer overflow (CWE‑787) may allow attackers to achieve higher privileges or crash the device.