CVE-2026-0581
Published: 05 January 2026
Summary
CVE-2026-0581 is a medium-severity Injection (CWE-74) vulnerability in Tenda Ac1206 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates command injection by validating and sanitizing user inputs such as modulename, option, data, and switch in the formBehaviorManager function.
Requires timely flaw remediation through firmware patching to eliminate the specific command injection vulnerability in the Tenda AC1206 httpd component.
Enforces least privilege on the httpd process to limit the impact of injected commands even if validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in public-facing router web interface enables exploitation of public-facing application (T1190) and arbitrary command execution on network device CLI (T1059.008).
NVD Description
A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a manipulation of the argument modulename/option/data/switch can lead to command injection. The attack can be…
more
launched remotely. The exploit has been publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2026-0581 is a command injection vulnerability affecting the Tenda AC1206 router running firmware version 15.03.06.23. The flaw resides in the formBehaviorManager function within the /goform/BehaviorManager file of the httpd component. An attacker can exploit it by manipulating the arguments modulename, option, data, or switch to inject and execute arbitrary commands.
The vulnerability enables remote exploitation over the network with low complexity and requires low privileges, such as those of an authenticated user (PR:L). Successful attacks can result in limited impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It maps to CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection).
Advisories on VulDB (ctiid.339473, id.339473, submit.731193) and a GitHub repository document the issue, including a publicly disclosed proof-of-concept exploit. The vendor's site at tenda.com.cn is referenced, but no specific patches or mitigation steps are detailed in the available information.
Details
- CWE(s)