CVE Intelligence
Analysis AI-assisted

CVE-2026-0581: Tenda AC1206 httpd formBehaviorManager command injection

CVE-2026-0581 is a command injection flaw (CWE-77) in the formBehaviorManager function of the httpd component of Tenda AC1206 version 15.03.06.23, reachable through /goform/BehaviorManager. The record describes it as remotely exploitable and states that an exploit has been publicly disclosed, while NVD assigns a CVSS 3.1 score of 9.8. The sources consulted show no fixed version and no confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0581 affects the httpd component of the Tenda AC1206 router, version 15.03.06.23. The record places the flaw in the formBehaviorManager function, reached through the /goform/BehaviorManager path. According to the description, manipulating the modulename, option, data and switch arguments can lead to command injection, classified as CWE-77. The CNA is VulDB.

Impact

  • The description says the attack can be launched remotely, which is the main driver of the high NVD score.
  • NVD's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates no privileges or user interaction are required, with high impact to confidentiality, integrity and availability.
  • Other scorers listed in the record (VulDB and cna@vuldb.com) assign lower scores, including 6.3 under CVSS 3.1, so the severity rating differs by source.
  • Successful command injection on a network device would generally allow an attacker to run operating system commands in the device context; the exact impact depends on the device configuration and is not detailed in the record.

Affected products and versions

  • Tenda AC1206, version 15.03.06.23.
  • Tenda Ac1206 Firmware, version 15.03.06.23.
  • No other version ranges are listed in the record. Versions before or after 15.03.06.23 are not confirmed as affected or unaffected by the available sources.

Exploitation status

  • The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded in KEV.
  • The description states that the exploit has been publicly disclosed and may be used. The record also contains a third-party reference tagged as an exploit, and the SSVC exploitation value is poc (proof of concept).
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.09413 (percentile 0.95412), which indicates elevated predicted likelihood relative to other CVEs, with the scoring date given as 2026-10-23.

Remediation and mitigation

  • The record lists no fixed version and no vendor patch. The absence of a listed fix does not confirm that none exists; check the vendor site and support channels for firmware updates.
  • Until an update is verified, reduce exposure: restrict access to the router's web management interface, avoid exposing it to the internet, and place management access behind trusted networks or VPN.
  • Review whether the device is still supported by the vendor and plan replacement if no fixed firmware is available.
  • Change default administrative credentials and disable remote management where it is not required.

Detection guidance

  • Review web server and device logs for unusual requests to the /goform/BehaviorManager path, especially from unexpected sources.
  • Monitor for unexpected configuration changes, new processes or outbound connections from the device, where the platform allows.
  • Apply network-level monitoring to management interfaces and alert on access from outside approved administrative ranges.

Limitations of the available information

  • No vendor advisory or fixed firmware version is included in the record.
  • The NVD score (9.8) differs from VulDB scores (for example 6.3 and 5.3 in different CVSS versions), and the reasons for the differences are not explained.
  • The record does not describe the exact conditions required for exploitation beyond the stated remote vector, nor which firmware builds other than 15.03.06.23 are affected.
  • The EPSS date is later than the publication date, so the EPSS value should be rechecked against a current feed.

Frequently asked questions

What is CVE-2026-0581?

It is a command injection vulnerability (CWE-77) in the formBehaviorManager function of the httpd component of Tenda AC1206 version 15.03.06.23, reachable through /goform/BehaviorManager.

Can it be exploited remotely?

The record states that the attack can be launched remotely, and the NVD CVSS 3.1 vector reflects a network attack vector with no privileges or user interaction required.

Is there a fix available?

The record lists no fixed version or vendor patch. Check the vendor's support channels for firmware updates, because the absence of a listed fix in the record does not prove none exists.

Is this vulnerability being exploited in the wild?

It is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The description says a public exploit has been disclosed.

What should administrators do now?

Restrict access to the management interface, avoid internet exposure, change default credentials, monitor requests to the affected path, and plan replacement if no supported firmware is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.