CVE-2026-8259 — Tenda AC6 2.0/15.03.06.23 Command Injection

title: CVE-2026-8259 - Tenda AC6 Command Injection via lan.ip parameter
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  This rule detects attempts to exploit CVE-2026-8259 on Tenda AC6 devices. The vulnerability allows for OS command injection through the 'lan.ip' parameter in the '/goform/telnet' endpoint. The detection looks for the specific URI path and query parameters indicative of an exploit attempt, including common command injection characters like ';', '`', or '$()'.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8259/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/goform/telnet'
      cs-uri-query|contains:
          - 'lan.ip='
      cs-uri-query|contains:
          - ';'
      cs-uri-query|contains:
          - '`'
      cs-uri-query|contains:
          - '$()'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse