A flaw in the Tenda AC6 firmware 15.03.06.49_multi_TDE01 allows an attacker to manipulate the mac or ssid parameters in the /goform/WifiExtraSet endpoint, resulting in OS command injection. The attack can be performed remotely, and public exploits have been released, enabling arbitrary command execution on the device. The vulnerability maps to CWE-77 and CWE-78, indicating unsanitized command line arguments, while the presence of buffer overflow is not described in the CVE details.

The affected product is the Tenda AC6 Wi‑Fi router running firmware version 15.03.06.49_multi_TDE01. No other vendors or products are listed in the CVE data.

The CVSS score of 5.1 classifies the issue as medium severity. EPSS score of 5% indicates a moderate exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable remotely via the web interface, and an exploit has already been publicly released, increasing the likelihood that resourceful adversaries may target vulnerable devices. The vulnerability does not appear to involve memory corruption or a buffer overflow, but attackers can execute arbitrary OS commands via the mac and ssid parameters.