A flaw in the Tenda AC6 firmware 15.03.06.49_multi_TDE01 allows an attacker to manipulate the mac or ssid parameters in the /goform/WifiExtraSet endpoint, resulting in OS command injection. An exploitation of this weakness can execute arbitrary commands on the device, potentially providing full control over the router. The weakness falls under CWE‑77 and CWE‑78, indicating that unsanitized command line arguments are being passed to the operating system.

The affected product is the Tenda AC6 Wi‑Fi router running firmware version 15.03.06.49_multi_TDE01. No other vendors or products are listed in the CVE data.

The CVSS score of 5.1 classifies the issue as medium severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable remotely via the web interface, and an exploit has already been publicly released, increasing the likelihood that resourceful adversaries may target vulnerable devices.