Tenda AC18 CVE-2026-38142

The vulnerability requires no authentication, no special configuration, and no user interaction - the /goform/fast_setting_internet_set endpoint is exposed by default on the LAN interface and may also be reachable via the WAN interface depending on whether remote management is enabled. The attack is network-accessible and automated. The second-order nature means exploitation requires two steps: first, a write request to store the payload via the mac parameter; second, a trigger condition (a follow-on request or an internal router event) that causes the stored value to be interpreted as a shell command. The trigger may be automatable without additional operator interaction, consistent with SSVC Automatable:yes. Exploitation is limited to firmware version v15.03.05.05; other Tenda AC18 firmware versions have not been confirmed affected. WAN-side exposure requires remote management to be enabled, which is not the default on most Tenda consumer devices - LAN-side exploitation requires attacker presence on the same local network segment.

Despite the relatively modest NVD CVSS base score of 6.5 (C:L/I:L/A:N), the real-world risk is considerably higher and the reported score appears underweighted for a network-accessible unauthenticated command injection primitive. SSVC signals confirm: exploitation is poc-stage and the attack is automatable with partial technical impact - but partial SSVC impact does not preclude router rootkit deployment. The CVSS C:L/I:L/A:N vector conflicts with the CWE-77 characterization: successful OS command injection on an embedded Linux router typically yields full confidentiality (credentials, VPN keys, PPPoE passwords), full integrity (firmware modification, DNS hijacking, traffic interception), and full availability (reboot, brick). This discrepancy should be verified against the vendor's advisory if one becomes available. EPSS data is absent from the input, so exploitation probability cannot be quantitatively benchmarked. KEV status is negative, indicating no confirmed mass exploitation at time of analysis. The combination of PR:N, AC:L, UI:N, and SSVC Automatable:yes means this is a strong candidate for automated scanning and exploit wormability if weaponized.

An unauthenticated remote attacker sends a crafted HTTP POST request to http://[router-ip]/goform/fast_setting_internet_set with the mac parameter containing a shell metacharacter payload such as ; id > /tmp/pwned &. The router's CGI handler writes the unsanitized value into a persistent configuration store, and when that configuration is subsequently applied or read by a privileged background process, the injected command executes as root. A proof-of-concept demonstrating this technique has been published by the researcher; the automatable SSVC rating indicates this can be scripted for mass scanning of internet-exposed Tenda AC18 units.