Skip to content
OpenAdvisories
Medium · 4.7 Public exploit CVE-2026-4253 EUVD-2026-12472GHSA-6g93-h28j-6gjp

Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

Published Mar 16, 2026 · Updated Mar 16, 2026 · Assigned by VulDB

Vendor: Tenda Product: AC8

Description

A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected products

VendorProductAffectedFixed
Tenda AC8 16.03.50.11 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • renzi25031469/CVE-2026-4253-Scanner ★ 0 · Jun 25, 2026

    Non-destructive vulnerability scanner for NGINX HTTP/3 (ngx_http_v3_module). It ONLY performs a safe probe: opens an HTTP/3 (QUIC) connection, sends a single HEAD request and inspects the `Server` re…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References