CVE-2026-8264 — Command Injection

title: Tenda AC6 WifiApScan Command Injection - CVE-2026-8264
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-8264 by targeting the WifiApScan function in Tenda AC6 devices. The rule looks for specific URI paths and query parameters used in the exploit, which include manipulations of 'wl2g.public.country' or 'wl5g.public.country' with characters indicative of command injection (e.g., ';', '|', '`', '$').
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8264/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/goform/WifiApScan'
      cs-uri-query|contains:
          - 'wl2g.public.country='
          - 'wl5g.public.country='
      cs-uri-query|contains:
          - ';'
          - '|'
          - '`'
          - '$'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse