The vulnerability resides in the formWifiApScan interface of Tenda AC6 firmware 15.03.06.23, where crafting specific values for the country parameters (wl2g.public.country or wl5g.public.country) allows an attacker to inject and execute arbitrary operating‑system commands. The attack is delivered via HTTP; based on the description, it is inferred that authentication is not required, enabling an attacker to run any shell command on the device without valid credentials.

Affected systems include Tenda AC6 routers running firmware version 15.03.06.23. The vulnerability is specific to the formWifiApScan interface in the httpd component. All Tenda AC6 devices with this firmware are impacted unless upgraded.

The CVSS score of 5.3 indicates moderate severity, but the combination of a remote trigger and an available public exploit elevates the overall risk. Based on the description, it is inferred that authentication is not required. The EPSS score of <1% indicates that the likelihood of exploitation is low, but the vulnerability remains within the scope of potential attacks. Because the router’s web interface is often reachable from external networks, a threat actor can target it with minimal effort, potentially leading to full device compromise. The lack of a CISA KEV listing does not diminish the threat, as the flaw remains runnable by anyone who can reach the router.