Tenda CVE-2026-4490

Requires authenticated access (PR:L) to Tenda A18 Pro router firmware version 02.03.02.28. Attacker must send crafted input to the /goform/openSchedWifi endpoint via the setSchedWifi function. No user interaction needed. Remote network access required.

The CVSS v3.1 score of 8.8 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), low privileges required (PR:L), and high impact across all CIA triad components. The presence of a publicly available proof-of-concept exploit (E:P as indicated in the temporal score and confirmed via GitHub reference https://github.com/lilukun337/cve/issues/2) substantially elevates real-world risk, as it enables script-kiddie level attackers to exploit this vulnerability without deep technical expertise. While low-privilege authentication is required, many IoT devices and routers have weak default credentials or previously compromised accounts, making this requirement a minimal barrier. The lack of official patch information (RL:X - remediation level unavailable) combined with public exploit availability makes this a high-priority issue for organizations using affected Tenda devices, particularly those internet-facing or in environments where lateral movement could occur after initial compromise.

An attacker with knowledge of valid low-privilege router credentials (potentially obtained through credential stuffing, default password exploitation, or prior compromise) authenticates to the Tenda A18 Pro web interface over the network. Using the publicly available proof-of-concept from GitHub, the attacker sends a specially crafted request to the /goform/openSchedWifi endpoint with oversized input to the setSchedWifi function, triggering the stack-based buffer overflow. This allows the attacker to overwrite the return address and execute arbitrary code, potentially installing persistent backdoors, pivoting to internal network segments, or using the compromised router as a command-and-control node for botnet operations.