Vulnerability · Published Apr 5, 2026 · Assigned by VulDB
CVE-2026-5547Tenda AC10 httpd formAddMacfilterRule os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in AC10 from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
References
- VDB-355311 | Tenda AC10 httpd formAddMacfilterRule os command injection vdb-entry, technical-description
- VDB-355311 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #782296 | Tenda AC10 V4 US_AC10V4.0si_V16.03.10.10_multi_TDE01 OS Command Injection third-party-advisory
- https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-03-command-injection-formaddmacfilterrule.md related
- https://www.tenda.com.cn/ product