CVE-2026-6989

CVE-2026-6989 is a command injection vulnerability affecting the Tenda F453 router firmware versions up to 1.0.0.3. The issue resides in the TendaTelnet function within the /goform/telnet endpoint of the Telnet Service component. Manipulation of this function enables arbitrary command execution, as classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Command Injection). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility and low attack complexity.

A remote attacker with low privileges can exploit this vulnerability without user interaction. By sending crafted requests to the affected endpoint, the attacker achieves command injection, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized access to system information, modification of router settings, or denial of minor services.

Advisories from VulDB detail the vulnerability and recent threat intelligence, while a GitHub repository discloses a public exploit that may be actively used. The vendor's website at tenda.com.cn provides general product information, but no specific patch or mitigation details are outlined in the available references; users should check for firmware updates beyond version 1.0.0.3.

The exploit's public disclosure heightens the risk of real-world exploitation against unpatched Tenda F453 devices.