A weakness in the Tenda AC6 router firmware version 15.03.06.23 allows an attacker to inject and execute arbitrary operating‑system commands through the formWifiApScan interface in the httpd component. The vulnerability is triggered by manipulating the wl2g.public.country or wl5g.public.country parameters sent to the /goform/WifiApScan endpoint, leading to OS command injection identified as CWE‑77 and CWE‑78. An attacker can exploit this flaw remotely using a standard HTTP request to the router’s web interface, potentially gaining full control of the device without authentication.

Affected systems consist of Tenda AC6 routers running firmware 15.03.06.23 or earlier. The flaw resides specifically in the formWifiApScan endpoint of the httpd web server. All devices with this firmware version that expose the /goform/WifiApScan path to an external network are impacted, unless they have been upgraded to a version that removes or hardens this interface.

The CVSS score of 5.3 indicates moderate severity, but the remote trigger and publicly available exploit increase the overall risk. The EPSS score of 3% suggests that exploitation is currently unlikely, yet the presence of unrestricted OS command execution means a potential attacker could compromise the entire router. The flaw is not listed in CISA KEV, but its availability to the public and the remote nature of the attack make it a high-priority risk for any network that exposes the router’s web interface to the internet or untrusted clients.