CVE-2026-4253 | Tenda AC8 16.03.50.11 Web Interface /cgi-bin/UploadCfg route_set_user_policy_rule wans.policy.list1 os command injection

A vulnerability was found in Tenda AC8 16.03.50.11. It has been declared as critical. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection.

This vulnerability is known as CVE-2026-4253. It is possible to launch the attack remotely. Furthermore, an exploit is available.