Tenda AC18 CVE-2025-11326

Exploitation requires sending a request to the specific endpoint /goform/WifiMacFilterSet with a manipulated wifi_chkHz parameter against Tenda AC18 firmware 15.03.05.19(6318); the overflow is in the Wi-Fi MAC-filter handler of the router's web management interface. The supplied CVSS vector is PR:L, meaning low-privilege access to that interface is expected rather than fully unauthenticated access - this is a limiting factor, as the management interface is typically bound to the LAN and not exposed to the internet by default, so exploitation usually presupposes LAN adjacency or an already-exposed/credentialed admin panel. No user interaction is required (UI:N). The flaw is tied to this exact firmware build, further narrowing the exposed population.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring some privilege level (PR:L), with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) but no scope change to other systems - yielding the input score of 7.4. Exploit maturity is Proof-of-Concept (E:P), which aligns with the independent signals: a public exploit write-up exists on GitHub, so publicly available exploit code exists, but this is NOT the same as active exploitation. The CVE is NOT in CISA KEV, and the EPSS score is low (1.24%, 68th percentile), together indicating no evidence of widespread or automated exploitation to date - consistent with a typical VulDB-reported consumer-router overflow that attracts security-researcher interest rather than mass exploitation. The principal uncertainty is the privilege requirement: the description states only that 'the attack may be performed from remote' and does not confirm whether authentication to the router web UI is needed; the PR:L in the supplied vector implies authenticated access, but this is not corroborated by the description - verify with the vendor or exploit PoC. Net assessment: a credible, patch-when-able issue for exposed Tenda AC18 devices, not an emergency given low EPSS, no KEV listing, the PR:L precondition, and the narrow single-model footprint.

An attacker with network reachability to the router's web management interface sends a crafted request to /goform/WifiMacFilterSet with an oversized or malformed wifi_chkHz argument, overflowing a stack buffer and corrupting control data to crash the service or execute arbitrary code on the device. A public proof-of-concept write-up exists (GitHub noahze01/IoT-vulnerable), lowering the effort to reproduce. Because the supplied CVSS vector is PR:L, the realistic scenario assumes the attacker can reach and authenticate to (or already has low-privilege access to) the management interface.