Tenda AC18 vulnerabilities
3 known CVE vulnerabilities in Tenda AC18, translated and rated.
- CVE-2022-35201Critical
A remote command execution (RCE) vulnerability was discovered in Tenda AC18 with firmware version V15.03.05.05. An attacker can exploit this flaw to take control of the device without authorization.
- CVE-2026-38142Medium
An unauthenticated command injection vulnerability exists in the /goform/fast_setting_internet_set endpoint of Tenda AC18 firmware version 15.03.05.05. An attacker can send a crafted request with a malicious payload in the mac parameter to execute arbitrary system commands.
- CVE-2026-11528High
Vulnerability in Tenda AC18 version 15.03.05.05: stack-based buffer overflow in function sub_45304 of file /goform/getRebootStatus (Web Management Interface component). An attacker can remotely trigger overflow via the callback argument. Exploit is publicly available.