CVE-2026-82695
CriticalCVSS 10.0Summary
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
An unauthenticated attacker may gain access to the telnet service without authentication, potentially leading to full control of the device.
Recommendation
Update the router firmware to the latest version if available. If not, restrict access to the device from trusted networks and consider disabling the telnet service.
Other vulnerabilities in Tenda AC18
See all- CVE-2022-35201Critical
A remote command execution (RCE) vulnerability was discovered in Tenda AC18 with firmware version V15.03.05.05. An attacker can exploit this flaw to take control of the device without authorization.
- CVE-2026-38142Medium
An unauthenticated command injection vulnerability exists in the /goform/fast_setting_internet_set endpoint of Tenda AC18 firmware version 15.03.05.05. An attacker can send a crafted request with a malicious payload in the mac parameter to execute arbitrary system commands.
- CVE-2026-11528High
Vulnerability in Tenda AC18 version 15.03.05.05: stack-based buffer overflow in function sub_45304 of file /goform/getRebootStatus (Web Management Interface component). An attacker can remotely trigger overflow via the callback argument. Exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.