CVE-2026-38142: Unauthenticated Command Injection in Tenda AC18 Routers

Technical summary

CVE-2026-38142 is an unauthenticated command injection vulnerability (CWE-77) in the /goform/fast_setting_internet_set endpoint of Tenda AC18 routers version 15.03.05.05. The vulnerability allows attackers to inject arbitrary OS commands via the 'mac' parameter without prior authentication. The affected endpoint processes user input without adequate input validation or sanitization, allowing shell metacharacters and command sequences to be interpreted by the underlying system. This results in direct command execution within the router's operating environment, potentially granting attackers shell-level access to the device.

Business impact

Compromise of a Tenda AC18 router can enable attackers to establish persistent access to an organization's network perimeter, intercept traffic, modify DNS settings, deploy malware, or launch attacks against connected devices. In enterprise environments, affected routers used for branch office connectivity or guest networks could serve as an entry point for lateral movement. In home office or small business settings, an attacker could exfiltrate data from connected devices, monitor user activity, or use the router as a launching point for attacks on other targets. The lack of authentication requirement significantly lowers the barrier to exploitation.

Affected systems

Tenda AC18 routers running firmware version 15.03.05.05 are confirmed vulnerable. Organizations should inventory Tenda AC18 deployments and determine which firmware versions are in use. Users should check their router's management interface or documentation to identify the current firmware version. This vulnerability affects the AC18 model specifically; other Tenda models may have similar or different vulnerabilities and should be assessed separately.

Exploitability

Exploitability is high due to the complete lack of authentication requirements and the simple attack vector—an HTTP request to a standard web interface endpoint. The vulnerability requires only network access to the router and no special tools or code execution capabilities on the attacker's machine. The CVSS score of 6.5 (MEDIUM) reflects the absence of confidentiality and integrity impact boundaries and the fact that availability is not directly compromised, though command execution could enable secondary attacks. However, the ease of exploitation and the privileged context of the router warrant treating this as a priority remediation target despite the MEDIUM severity rating.

Remediation

Organizations should immediately apply firmware updates from Tenda that address this vulnerability. Verify the patched firmware version against Tenda's official advisory. Until patches are deployed, implement network-level controls: restrict access to router management interfaces using firewall rules, disable remote management if not required, and place routers behind additional access controls. Monitor router logs for suspicious requests to the /goform/fast_setting_internet_set endpoint. Affected routers should be inventoried and prioritized for patching based on network exposure and criticality.

Patch guidance

Contact Tenda for the latest firmware release addressing CVE-2026-38142 and verify patch availability through official channels. Firmware updates should be applied through the router's management interface or via the manufacturer's update tool. Before deploying patches, test in a non-production environment if possible. Document the pre- and post-patch firmware versions for compliance tracking. Once patched, confirm that the router is fully functional and that no configuration drift has occurred. Maintain a record of patch deployment dates for vulnerability management reporting.

Detection guidance

Monitor network traffic to the router's web interface for requests to the /goform/fast_setting_internet_set endpoint, particularly those containing suspicious characters or command sequences in parameters. Log analysis should search for HTTP POST requests with encoded or obfuscated payloads in the 'mac' parameter. Enable router logging if available and review for unusual command execution patterns or privilege escalation attempts. Network-based detection signatures should flag requests containing shell metacharacters (e.g., $, `, |, ;, &) in parameter values sent to this endpoint. Correlation of such requests with subsequent unusual router behavior (DNS changes, traffic redirection, configuration modifications) can indicate exploitation attempts.

Why prioritize this

Despite the MEDIUM CVSS score, this vulnerability should be prioritized due to its unauthenticated attack vector, complete lack of access controls, and ability to grant command execution on network infrastructure. Routers are critical network chokepoints; their compromise often enables broader network attacks. The simplicity of exploitation means this vulnerability could be targeted opportunistically by less-sophisticated attackers. Organizations with exposed router management interfaces or routers on untrusted networks should treat this as a critical priority.

Risk score, explained

The CVSS:3.1 score of 6.5 reflects a network-accessible vulnerability with low complexity, no authentication required, and integrity/confidentiality impact within the impacted component (the router itself). The score does not account for the strategic importance of routers as network infrastructure or the potential for chained attacks. In real-world risk assessment, the actual organizational risk may be higher depending on router exposure, segmentation, and the presence of compensating controls.

Frequently asked questions