CVE-2026-38142

MEDIUM

Tenda AC18 15.03.05.05 - Unauthenticated OS Command Injection via /goform/fast_setting_internet_set mac Parameter

Title source: llm

Description

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter.

References (1)

Core 1

Core References

https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/blob/main/Tenda%20AC18%20Unauthenticated%20Second-Order%20OS%20Command%20Injection%20in%20goformfast_setting_internet_set.pdf

View Writeup ZIP pw:eip

Scores

CVSS v3 6.5

EPSS 0.0069

EPSS Percentile 49.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-77

Status published

Published Jul 01, 2026

Tracked Since Jul 02, 2026