Command Injection Vulnerability in Tenda AC18 Router
CVE-2026-38142

6.5MEDIUM

Key Information:

Vendor

Tenda
Status
AC18 Router
Vendor
CVE Published:
1 July 2026

What is CVE-2026-38142?

The Tenda AC18 router has a notable vulnerability in its /goform/fast_setting_internet_set endpoint, which allows unauthenticated attackers to inject arbitrary commands through the mac parameter. This command injection flaw can lead to unauthorized actions being executed on the device, compromising its integrity and potentially exposing the network to further attacks. It's crucial for users of affected versions to implement immediate security measures.

References

https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/bl...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.