A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
References
| Link | Resource |
|---|---|
| https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md | Exploit Third Party Advisory |
| https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
28 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md - Exploit, Third Party Advisory |
28 Apr 2026, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Tenda
Tenda ac18 Firmware Tenda ac18 |
|
| References | () https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:o:tenda:ac18_firmware:15.03.05.05:*:*:*:*:*:*:* cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:* |
|
| CWE | CWE-77 |
27 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-27 19:16
Updated : 2026-04-28 15:16
NVD link : CVE-2026-31255
Mitre link : CVE-2026-31255
CVE.ORG link : CVE-2026-31255
JSON object : View
Products Affected
tenda
- ac18
- ac18_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')