EUVD-2026-35092
GHSA-g4hg-4wjv-mfcm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Tenda AC18 admin panel
-
DeliveryObtain or reuse low-privileged credentials
-
ExploitSend crafted HTTP request to /goform/getRebootStatus
-
ExecutionOverflow stack buffer in sub_45304 via callback param
-
PersistHijack saved return address
-
ImpactExecute shellcode as root on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker requires network reachability to the Tenda AC18's Web Management Interface (HTTP) and low-privileged authenticated access per CVSS PR:L - typically valid login credentials to the router admin panel. The target must be running firmware 15.03.05.05 on the AC18 hardware. Exploitation is limited by: (1) management interface exposure - devices not exposing admin to the WAN are reachable only from the LAN; (2) credential requirement per CVSS, though Tenda SOHO devices frequently ship with weak or default credentials that may not meaningfully limit attackers; (3) the specific /goform/getRebootStatus endpoint and callback parameter must be reachable. No user interaction is required (UI:N). |
| Impact | CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/E:P scores 7.4 (High), reflecting network reachability, low attack complexity, no user interaction, and high CIA impact - but PR:L indicates some authentication is required, which limits exposure if the admin interface is not internet-facing or credentials are unique. Publicly available exploit code (per the GitHub reference Robots10/IoT_vlu) significantly lowers the skill barrier and the 'E:P' (Proof-of-Concept) exploit maturity in the vector confirms this. There is no CISA KEV listing and no EPSS data was provided in the input, so widespread automated exploitation cannot be confirmed at this time. The realistic risk is highest for devices with internet-exposed web management or weak/default credentials - common in SOHO deployments - making this a meaningful priority despite the PR:L caveat. Note: the description states 'remote' attack but CVSS shows PR:L; defenders should confirm whether authentication is actually enforced on this endpoint, as Tenda devices have a history of pre-auth /goform/ flaws. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged credentials (or accesses an internet-exposed admin interface with weak credentials) sends a crafted HTTP request to /goform/getRebootStatus with an overlong callback parameter value. The oversized input overflows the stack buffer inside sub_45304, overwriting the saved return address and redirecting execution to attacker-supplied shellcode, achieving code execution as the router's web service (typically root on embedded MIPS/ARM Linux). With public POC code already published on GitHub, this attack requires minimal customization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Stack-based buffer overflow in the Tenda AC18 router (firmware 15.03.05.05) Web Management Interface allows remote attackers with low privileges to corrupt memory by manipulating the callback argument sent to /goform/getRebootStatus. The flaw, handled by the sub_45304 function, has publicly available exploit code and enables high impact to confidentiality, integrity, and availability of the device. No public exploit identified as actively exploited in CISA KEV, but POC publication raises the risk of opportunistic attacks against exposed management interfaces.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda AC18 router (firmware 15.03.05.05) Web Management Interface allows authenticated remote attackers to corrupt memory by manipulating the callback parameter sent to /goform/getRebootStatus. Publicly available exploit code exists for the sub_45304 handler, raising the practical risk despite low-privilege authentication being required, though no CISA KEV listing or EPSS data is provided to confirm in-the-wild exploitation.
Stack-based buffer overflow in Tenda AC18 router firmware 15.03.05.05 allows remote authenticated attackers to corrupt memory via the callback parameter of the /goform/getRebootStatus endpoint handled by function sub_45304 in the Web Management Interface. Publicly available exploit code exists, and the CVSS 8.8 score combined with low attack complexity makes this a high-priority issue for any exposed AC18 devices. No public CISA KEV listing has been observed, so this is not yet confirmed actively exploited, but the public PoC increases opportunistic risk.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware version in the available references. As compensating controls, immediately restrict access to the router's web management interface to trusted LAN clients only by disabling remote/WAN administration (typically under System Tools → Remote Management), which eliminates the network attack vector at the cost of losing remote configuration capability. Place the device behind a separate firewall or ACL that blocks inbound HTTP/HTTPS to the router's management port from untrusted networks, and ensure strong unique admin credentials are set since PR:L indicates authentication is part of the attack path. Monitor the vendor site (https://www.tenda.com.cn/) and the public report (https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/getRebootStatus/getRebootStatus.md) for patched firmware; if no fix is forthcoming, consider replacing the device, as end-of-life SOHO routers frequently accumulate similar unpatched flaws.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Tenda AC18 wireless router's web-based management interface, which processes HTTP requests through CGI-style handlers in /goform/ endpoints. The affected function sub_45304 (an internal symbol identified through reverse engineering) handles the getRebootStatus endpoint and fails to validate the length of the callback parameter before copying it into a fixed-size stack buffer. This is a classic CWE-121 (Stack-based Buffer Overflow), where attacker-controlled input overwrites the return address or stack canaries (if present), potentially redirecting execution. Tenda's consumer-grade SOHO routers are well-known targets for similar /goform/ overflow issues, and the affected CPE is cpe:2.3:a:tenda:ac18:*:*:*:*:*:*:* - covering all versions matching the 15.03.05.05 firmware family.
Know when Ac18 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of the component Web Management Interface. The manipulation of the argument callback results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Executive ViewAI
The Tenda AC18 router (firmware 15.03.05.05) contains a memory corruption vulnerability affecting device confidentiality, integrity, and availability. Publicly available exploit code exists with no vendor patch available, significantly elevating the risk of attack against organizations with exposed management interfaces. This creates an immediate vulnerability for any deployment relying on this router model.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the web management interface to authorized administrative networks only via firewall rules; (2) Disable remote management functionality if local access is sufficient; (3) Implement network segmentation to isolate router from direct internet exposure; (4) Deploy intrusion detection signatures for buffer overflow exploitation patterns; (5) Monitor device logs and network traffic for anomalous access attempts; (6) Prioritize evaluation and migration to alternative router solutions with active vendor security support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB