What is the CVSS score of CVE-2026-38142?

CVE-2026-38142 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.7%.

Tenda AC18 CVE-2026-38142

MEDIUM

Command Injection (CWE-77)

2026-07-01 mitre

Command Injection Tenda N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

10.0 CRITICAL

Unauthenticated network command injection on a router yields full C/I/A and scope change affecting downstream network traffic; AC:L confirmed by SSVC Automatable:yes.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 20:53 vuln.today

CVSS changed

Jul 01, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter.

AnalysisAI

Unauthenticated OS command injection in Tenda AC18 v15.03.05.05 exposes the device to full remote compromise via a crafted HTTP request to the /goform/fast_setting_internet_set endpoint. The vulnerability is a second-order (stored) injection through the mac parameter - malicious payloads are written into device configuration and executed when triggered. No public exploit identified at time of analysis, though SSVC confirms a proof-of-concept exists and the attack is automatable, making mass exploitation technically feasible against internet-exposed devices.

Technical ContextAI

The Tenda AC18 is a consumer/SOHO dual-band wireless router running firmware v15.03.05.05. The affected endpoint /goform/fast_setting_internet_set handles quick internet setup configuration, and the mac parameter is passed to a shell command without sanitization, satisfying CWE-77 (Improper Neutralization of Special Elements used in a Command). The second-order nature documented in the researcher's PDF indicates the injected value is first persisted to device storage or configuration, then executed in a subsequent privileged context - a common pattern in embedded Linux firmware where goform CGI handlers write parameters into UCI or similar config files that are later consumed by scripts running as root. The CPE provided (cpe:2.3:a:n/a:n/a) is non-specific and does not enumerate the firmware precisely; the exact affected scope is confirmed by the researcher's documentation to be v15.03.05.05.

RemediationAI

No vendor-released patch has been identified at time of analysis; Tenda has not published a security advisory for this CVE. Until a patched firmware is released, administrators should immediately disable remote (WAN-side) management access on the AC18 to prevent unauthenticated internet exposure of the /goform/ CGI interface - this eliminates the most critical attack surface but does not protect against LAN-side threats from compromised devices. If the router's administration panel must remain accessible, restrict access to trusted IP ranges using the router's access control or upstream firewall rules; this raises the effective attack complexity significantly. Network segmentation placing the router's management plane behind a separate VLAN or jump host limits lateral post-exploitation reach. Monitor for unexpected outbound connections or DNS changes from the router as indicators of compromise. Check the researcher's GitHub repository at the reference URL and the Tenda support portal for firmware updates, and apply any released update immediately. Do not rely on the router's built-in firewall alone as compensating control - the vulnerable endpoint is served by the router itself.