Tenda AC18
CVE-2025-14993
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web UI and authenticate (PR:L)
-
DeliverySend crafted POST to /goform/SetDlnaCfg
-
ExploitOversized scanList overflows stack buffer via sprintf
-
ExecutionOverwrite return address, hijack control flow
-
ImpactExecute code on router (typically root)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the Tenda AC18 web management/HTTP interface and low-privilege authenticated access (PR:L) to invoke the /goform/SetDlnaCfg endpoint with an attacker-controlled scanList value; no user interaction is needed. Limiting factors: the attacker must be able to reach and authenticate to the management UI - normally exposed only to the LAN unless remote/WAN management is explicitly enabled - and exploitation is specific to firmware 15.03.05.05 on the AC18 model. No non-default feature toggle beyond reaching the DLNA config handler is indicated. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) describes a network-reachable, low-complexity stack overflow requiring only low-privilege authentication (PR:L) and no user interaction, yielding high confidentiality/integrity/availability impact on the device - consistent with router code execution, since Tenda /goform handlers typically run as root. Exploit maturity is E:P (proof-of-concept), and a public POC exists on GitHub, so publicly available exploit code exists - but this must not be conflated with active exploitation: there is no CISA KEV listing and no EPSS score supplied, so widespread automated exploitation is not evidenced. The realistic profile is a well-understood consumer-router memory-corruption bug reachable by any user who can reach the web management interface and authenticate; the main mitigating factor is PR:L (authentication needed) and that AC18's admin interface is normally LAN-facing rather than internet-exposed. The reporting-cvss is CVSS 4.0 only (no NVD 3.1 vector), and CWE is the imprecise CWE-119 rather than CWE-121 stack overflow - flagged as inference, not conflict. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (LAN, or WAN if remote management is enabled) authenticates as a low-privilege user and sends a crafted HTTP request to /goform/SetDlnaCfg with an oversized scanList argument. The unbounded sprintf overflows a stack buffer in the HTTP request handler, corrupting the return address and allowing code execution on the device. A public proof-of-concept demonstrating the crash/reproduction is available on GitHub (z472421519/BinaryAudit). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis, and there is no fix version referenced in the available advisories, so mitigation must be compensating until Tenda publishes updated AC18 firmware. First, disable remote/WAN administration so the web management interface is reachable only from the local network, and restrict which LAN clients can reach the router's management UI - this directly removes the AV:N attack path but does not eliminate the risk from an insider or already-compromised LAN host. Second, if DLNA is not required, disable the DLNA/media server feature so the /goform/SetDlnaCfg handler is not exercised, at the cost of losing media-sharing functionality. Third, change default administrative credentials and enforce strong unique passwords, since exploitation requires authenticated low-privilege access (PR:L), reducing the likelihood that an attacker can obtain the necessary session. Fourth, segment IoT and guest devices onto a separate VLAN or SSID with client isolation to limit who can reach the management endpoint. Finally, monitor router logs and network traffic for anomalous POST requests to /goform/SetDlnaCfg with unusually long scanList values as a detection signal, and consider replacing the device with a model that receives active firmware maintenance if no update becomes available. Cite the VulDB entry (https://vuldb.com/?id.337687), the PoC repository (https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_AC18/SetDlnaCfg/SetDlnaCfg.md), and Tenda's support site (https://www.tenda.com.cn/) when tracking remediation status.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in the DLNA configuration handler of the Tenda AC18 embedded web server. The HTTP Request Handler for /goform/SetDlnaCfg parses a client-supplied scanList argument and passes it into an sprintf call that writes into a fixed-size stack buffer without validating the input length; an oversized value overwrites adjacent stack memory, corrupting saved registers and the return address. Because the overflow occurs in the same process that services management requests, successful exploitation can hijack control flow within the router's firmware, resulting in remote code execution in the context of that service, or at minimum a denial-of-service crash and reboot. The affected component is identified by CPE cpe:2.3:o:tenda:ac18_firmware:15.03.05.05, confirming the issue is specific to AC18 hardware running that firmware build, and the vendor-reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/E:P) matches the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in requiring authenticated network access with no user interaction.
Know when IoT gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity stack overflow needing only low-privilege auth (PR:L) to the web UI; code exec on a device that runs handlers as root gives full C/I/A:H, no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler. The manipulation of the argument scanList results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.
Executive ViewAI
Tenda AC18 routers running firmware 15.03.05.05 are affected by a high-severity memory-corruption flaw that can be triggered by an authenticated low-privilege user with network access to the device's web management interface, potentially causing a crash or code execution on the router. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, so organizations cannot rely on a vendor fix for immediate protection. Leadership should care because these devices often sit at network boundaries; compromise or disruption can interrupt connectivity, expose internal segments, and require costly replacement or containment.
No vendor-released patch identified at time of analysis; interim mitigations include disabling WAN/remote management and UPnP/DLNA where not required, restricting web management to a trusted management VLAN or VPN, isolating Tenda AC18 devices on a dedicated network segment, blocking access to /goform/SetDlnaCfg from untrusted networks, enforcing strong unique admin credentials and least-privilege accounts, monitoring HTTP management logs for exploitation attempts, and planning replacement with supported hardware.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
Exploit-DB