Vulnerability · Published Jan 5, 2026 · Assigned by VulDB

CVE-2026-0581Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection

Medium 6.3

In plain English

A medium-severity command injection in AC1206 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.4% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)9.4%top 4.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
Tenda	AC1206	15.03.06.23

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-339473 | Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection vdb-entry, technical-description
VDB-339473 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #731193 | Tenda AC1206 AC1206V1.0RTL_V15.03.06.23 Command Injection third-party-advisory
https://github.com/ccc-iotsec/cve-/blob/Tenda/Tenda%20AC1206%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md exploit
https://www.tenda.com.cn/ product