Which versions of Tenda AC18 are affected by CVE-2026-11528?

The Tenda AC18 router (firmware 15.03.05.05) contains a memory corruption vulnerability affecting device confidentiality, integrity, and availability.

Is there a public PoC exploit available for CVE-2026-11528?

Yes, a public proof-of-concept exploit is available for CVE-2026-11528. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11528?

Within 24 hours: Identify and inventory all Tenda AC18 routers in use, specifically noting which devices run firmware 15.03.05.05 and have internet-accessible web management interfaces. Within 7 days: Restrict network access to router web management interfaces to authorized administrative networks using firewall rules; deploy IDS/IPS signatures to detect exploitation attempts against CVE-2026-11528. Within 30 days: Evaluate hardware replacement with alternative router vendors offering active security patch support, or implement persistent network segmentation and disable remote management if replacement is not feasible.

Tenda AC18 CVE-2026-11528

Q: What is the CVSS score of CVE-2026-11528?

CVE-2026-11528 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35092 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-g4hg-4wjv-mfcm

Buffer Overflow Stack Overflow Tenda Ac18

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 08, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 08, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 08, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 16:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 08, 2026 - 16:18 vuln.today

DescriptionCVE.org

A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of the component Web Management Interface. The manipulation of the argument callback results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in the Tenda AC18 router (firmware 15.03.05.05) Web Management Interface allows remote attackers with low privileges to corrupt memory by manipulating the callback argument sent to /goform/getRebootStatus. The flaw, handled by the sub_45304 function, has publicly available exploit code and enables high impact to confidentiality, integrity, and availability of the device. No public exploit identified as actively exploited in CISA KEV, but POC publication raises the risk of opportunistic attacks against exposed management interfaces.

Technical ContextAI

The vulnerability resides in the Tenda AC18 wireless router's web-based management interface, which processes HTTP requests through CGI-style handlers in /goform/ endpoints. The affected function sub_45304 (an internal symbol identified through reverse engineering) handles the getRebootStatus endpoint and fails to validate the length of the callback parameter before copying it into a fixed-size stack buffer. This is a classic CWE-121 (Stack-based Buffer Overflow), where attacker-controlled input overwrites the return address or stack canaries (if present), potentially redirecting execution. Tenda's consumer-grade SOHO routers are well-known targets for similar /goform/ overflow issues, and the affected CPE is cpe:2.3:a:tenda:ac18:*:*:*:*:*:*:* - covering all versions matching the 15.03.05.05 firmware family.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware version in the available references. As compensating controls, immediately restrict access to the router's web management interface to trusted LAN clients only by disabling remote/WAN administration (typically under System Tools → Remote Management), which eliminates the network attack vector at the cost of losing remote configuration capability. Place the device behind a separate firewall or ACL that blocks inbound HTTP/HTTPS to the router's management port from untrusted networks, and ensure strong unique admin credentials are set since PR:L indicates authentication is part of the attack path. Monitor the vendor site (https://www.tenda.com.cn/) and the public report (https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/getRebootStatus/getRebootStatus.md) for patched firmware; if no fix is forthcoming, consider replacing the device, as end-of-life SOHO routers frequently accumulate similar unpatched flaws.