CVE-2026-0581 is a command injection flaw in the web server of the Tenda AC1206 router, firmware 15.03.06.23. NVD scores it 6.3, medium severity, and the record says an exploit is public. No fixed firmware is named, so lock down remote admin and check Tenda for an update.
What's affected
- Product: Tenda AC1206 and its firmware, version 15.03.06.23.
- Component: the formBehaviorManager function behind /goform/BehaviorManager in the httpd web server, arguments modulename, option, data and switch.
- Fixed version: none listed. Check the vendor site for your model.
- Severity: CVSS 6.3, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Low privileges are required, so a router login is assumed. - Exploitation: the record says the exploit is public. It is not on the CISA KEV list.
How to check if you're exposed
Router and firewall firmware is not scanned by a package manager, so the check is manual.
- Log in to the device admin page and read the firmware version on the status or system page.
- Compare it with the version named in this post.
- Test from outside your network that the management interface does not answer. From a host you own on another network:
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
The firmware in this report is AC1206V1.0RTL_V15.03.06.23. If your device shows a different build, the record does not say whether it is affected, so ask Tenda.
What to do now
- Open the Tenda support site (https://www.tenda.com.cn/) and look for a newer firmware for your exact model. The CVE record does not name a fixed version.
- If a newer firmware exists, read its release notes, back up the device configuration, and install it during a quiet window.
- Turn off remote administration from the internet. Management should be reachable only from a trusted LAN or VPN.
- Change the admin password if it is shared or old, and remove any accounts you do not use.
- If no update exists and the device sits at the edge of a network that matters, plan its replacement. Record the CVE in your asset register until then.
Why it matters
The weakness is CWE-77 (improper neutralization of special elements in a command), a child of CWE-74 (injection). The public report, written in Chinese, says the handler reads several request parameters and passes the data parameter to a system command helper without filtering it.
On a home or small office router, a command that runs on the device runs with the rights of the router itself. That is why a medium CVSS score should not make you relax: the router sits between everything you own and the internet.
Quick check
Can a router flaw with low privileges still matter?
Yes. A router login is often protected by a default or shared password, and the device carries all your traffic. Treat the admin page as sensitive.
Is there a firmware fix?
The CVE record does not name one. Check the Tenda support page for your model, and plan a replacement if none appears.
Sources
Last reviewed: 19 October 2026.
