What is the CVSS score of CVE-2026-31255?

CVE-2026-31255 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tenda AC18 are affected by CVE-2026-31255?

Tenda AC18 routers running firmware V15.03.05.05_multi contain a critical remote command injection vulnerability (CVE-2026-31255) that allows unauthenticated attackers to gain complete control of…

How to fix or mitigate CVE-2026-31255?

Within 24 hours: Identify all Tenda AC18 routers in your environment and verify firmware version via administrative console (Settings > System Settings > Firmware Version). Within 7 days: Isolate affected devices to a segregated network segment and restrict administrative access to trusted networks only; contact Tenda support for firmware update status and ETA. Within 30 days: Deploy replacement routers from vendors with active security support or implement compensating controls (network segmentation, WAF rules blocking /goform/SetSambaCfg requests, network-based command execution detection).

Tenda AC18 CVE-2026-31255

EUVD-2026-25898 CRITICAL

Command Injection (CWE-77)

2026-04-27 mitre

Tenda Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 14:53 vuln.today

CVSS changed

Apr 28, 2026 - 14:52 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 27, 2026 - 19:00 euvd

EUVD-2026-25898

Analysis Generated

Apr 27, 2026 - 19:00 vuln.today

CVE Published

Apr 27, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.

AnalysisAI

Remote unauthenticated command injection in Tenda AC18 router firmware V15.03.05.05_multi allows complete device compromise via the SetSambaCfg interface. Attackers can execute arbitrary system commands by manipulating the guestuser parameter in HTTP requests to /goform/SetSambaCfg. CVSS 9.8 critical severity with network attack vector and no authentication required. EPSS score of 0.06% (19th percentile) suggests low observed exploitation despite extreme technical severity. Publicly documented exploit proof-of-concept exists on GitHub.

Technical ContextAI

The vulnerability affects the Samba/SMB file sharing configuration interface in Tenda AC18 wireless router firmware. The /goform/SetSambaCfg endpoint processes configuration parameters for network file sharing but fails to sanitize the guestuser parameter before passing it to system command execution functions. This is a classic CWE-77 command injection flaw where user-controlled input is concatenated into shell commands without proper escaping or validation. The affected firmware version V15.03.05.05_multi runs on embedded Linux systems typical of consumer routers, where web interfaces execute commands with root privileges. Router management interfaces commonly process configuration parameters through CGI-like handlers that directly invoke system utilities, making command injection particularly dangerous since successful exploitation grants complete administrative control over the device.

RemediationAI

No vendor-released patch identified at time of analysis-Tenda has not published security advisories or firmware updates addressing CVE-2026-31255 according to available references. Until vendor patches become available, implement these compensating controls: (1) Disable remote management access to the router's web interface-restrict admin panel access to LAN-only connections by disabling WAN-side management in router settings under System Administration or Remote Management; this prevents internet-based exploitation but does not protect against LAN-based attackers. (2) Disable Samba/SMB file sharing functionality entirely if not required for network operations; this removes the vulnerable /goform/SetSambaCfg endpoint from the attack surface but eliminates file sharing capability. (3) Deploy network segmentation to isolate the router's management interface on a dedicated VLAN accessible only to authorized administrators; this reduces exposure but requires additional network infrastructure. (4) Monitor for replacement-consider migrating to alternative router hardware with active security support, as consumer router vendors including Tenda have poor track records for publishing timely security patches for end-of-life firmware. Reference: https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md contains technical details but no remediation guidance.