CVE-2022-35201
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
A remote command execution (RCE) vulnerability was discovered in Tenda AC18 with firmware version V15.03.05.05. An attacker can exploit this flaw to take control of the device without authorization.
Risk Assessment
The risk involves potential remote takeover of the Tenda AC18 router, which could lead to network compromise, data theft, or use of the device in DDoS attacks.
Recommendation
Immediately update the Tenda AC18 firmware to the latest available version that patches this vulnerability. If no update is available, consider disconnecting the device from the network or implementing additional network security measures.
Other vulnerabilities in Tenda AC18
See all- CVE-2026-82695Critical
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-38142Medium
An unauthenticated command injection vulnerability exists in the /goform/fast_setting_internet_set endpoint of Tenda AC18 firmware version 15.03.05.05. An attacker can send a crafted request with a malicious payload in the mac parameter to execute arbitrary system commands.
- CVE-2026-11528High
Vulnerability in Tenda AC18 version 15.03.05.05: stack-based buffer overflow in function sub_45304 of file /goform/getRebootStatus (Web Management Interface component). An attacker can remotely trigger overflow via the callback argument. Exploit is publicly available.
Original NVD description (English source)
Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.