The vulnerability resides in the formWifiApScan interface of Tenda AC6 firmware 15.03.06.23, where crafting specific values for the country parameters (wl2g.public.country or wl5g.public.country) allows an attacker to inject and execute arbitrary operating‑system commands. The flaw is a classic OS command injection (CWE-77 and CWE-78), giving a remote attacker the ability to run any shell command on the device. The exploit is delivered via HTTP, requiring only the ability to send a request to the router; authentication is not necessary. The CVSS score of 5.3 reflects moderate severity, but the public availability of an exploit and the lack of authentication make the risk high in environments where the router is exposed to untrusted networks. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and potential for full device compromise warrant urgent attention.

Affected systems include Tenda AC6 routers running firmware version 15.03.06.23. The vulnerability is specific to the formWifiApScan interface in the httpd component. All Tenda AC6 devices with this firmware are impacted unless upgraded.

The CVSS score of 5.3 indicates moderate severity, but the combination of an unauthenticated remote trigger and an available public exploit elevates the overall risk. Because the router’s web interface is often reachable from external networks, a threat actor can target it with minimal effort, potentially leading to full device compromise. The lack of a CISA KEV listing does not diminish the threat, as the flaw remains runnable by anyone who can reach the router. In environments where the device is exposed, the exploit is trivial to launch.