Tenda AC18 Firmware CVE-2025-8182

The vulnerability requires that Samba services be remotely network-accessible (AV:N is confirmed). Attack complexity is high (AC:H), meaning the attacker must overcome technical barriers such as active brute-force detection, account lockout mechanisms, or network-level filtering that may mitigate dictionary attacks. No user interaction (UI:N) or authentication (PR:N) is needed to initiate an attack, but successful credential compromise requires the attacker to guess weak passwords before lockout or rate-limiting stops the attempt. Exploitation is practical only if Samba is enabled and directly reachable from untrusted network segments; deployments where SMB access is restricted to isolated LANs or behind additional authentication layers significantly reduce exploitability.

CVSS 4.0 with AV:N/AC:H indicates network accessibility but high attack complexity; the vector also limits confidentiality, integrity, and availability impact to Low (VC:L/VI:L/VA:L). EPSS 0.07% (20th percentile) strongly contradicts the CVSS rating, suggesting this vulnerability is rarely exploited in practice despite public disclosure. The AC:H (high complexity) factor aligns with EPSS data - attackers must overcome technical barriers such as brute-force rate limiting, account lockout policies, or Samba-specific hardening despite weak password rules. No KEV (CISA Exploited Vulnerabilities Catalog) listing indicates no confirmed active exploitation by threat actors. The public POC availability (E:P per CVSS vector) provides proof-of-concept but does not translate to widespread real-world abuse. For organizations operating Tenda AC18 in isolated or trusted networks, risk is minimal; exposure is relevant only where Samba services are directly network-accessible to untrusted clients. The mismatch between CVSS severity (4.0) and EPSS exploitation probability (20th percentile) suggests this is a low-priority remediation candidate unless environmental factors (e.g., internet-facing SMB) increase exposure.

An attacker on the network discovers the Tenda AC18 router is exposing SMB services on port 445. Using a brute-force tool or custom script, the attacker iterates through a dictionary of weak passwords against known or enumerated Samba user accounts (such as default guest or admin accounts). Despite Samba's normal rate-limiting, the weak password requirements in smb.conf allow faster convergence to valid credentials, potentially yielding access to shared files or further network pivoting.