Which versions of Tenda are affected by CVE-2026-4492?

A critical vulnerability in Tenda A18 Pro routers allows authenticated attackers to gain complete control of affected devices through a publicly available exploit, potentially compromising network…

Is there a public PoC exploit available for CVE-2026-4492?

Yes, a public proof-of-concept exploit is available for CVE-2026-4492. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4492?

Within 24 hours: Inventory all Tenda A18 Pro routers running firmware 02.03.02.28 and isolate affected devices from critical network segments; disable the /goform/formSetQosBand endpoint if possible via administrative access controls. Within 7 days: Restrict administrative access to affected routers to authorized personnel only, implement network segmentation to limit lateral movement, and monitor for suspicious authentication logs. Within 30 days: Replace vulnerable router firmware with patched versions when available from Tenda, or evaluate replacement with alternative networking equipment from vendors with active security support; document all affected devices and track patch status.

Tenda CVE-2026-4492

Q: What is the CVSS score of CVE-2026-4492?

CVE-2026-4492 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13740 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-20 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Apr 22, 2026 - 21:37 NVD

8.8 (HIGH) 7.4 (HIGH)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 17:30 euvd

EUVD-2026-13740

Analysis Generated

Mar 20, 2026 - 17:30 vuln.today

CVE Published

Mar 20, 2026 - 17:02 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Remote code execution in Tenda A18 Pro firmware 02.03.02.28 allows authenticated attackers to achieve full system compromise through stack-based buffer overflow in the QoS configuration function. Public exploit code exists for this vulnerability and no patch is currently available, leaving deployed devices at immediate risk.

Technical ContextAI

This vulnerability affects the Tenda A18 Pro wireless router (CPE: cpe:2.3:a:tenda:a18_pro), specifically firmware version 02.03.02.28 or earlier. The root cause is a CWE-121 stack-based buffer overflow occurring in the set_qosMib_list function within the Quality of Service (QoS) bandwidth configuration module at /goform/formSetQosBand. Stack-based buffer overflows occur when user-supplied data exceeds the allocated buffer size on the program stack without proper bounds checking, allowing attackers to overwrite return addresses and execute arbitrary code. The vulnerability is triggered through manipulation of the 'list' parameter, suggesting insufficient input validation on QoS configuration data submitted via the router's web management interface.

RemediationAI

Contact Tenda or check the vendor website at https://www.tenda.com.cn/ for firmware updates addressing this vulnerability, as the CVSS temporal metrics indicate no official remedy or workaround was available at initial disclosure (RL:X). Until patches become available, implement network-level compensating controls: restrict management interface access to trusted IP addresses only, disable remote administration features if not required, change default credentials to strong unique passwords, and place affected devices behind additional firewall layers to limit attack surface. Consider replacing the device with alternative hardware if Tenda does not release security updates in a timely manner, as consumer routers often receive limited long-term support. Monitor VulDB references at https://vuldb.com/?id.352018 and https://vuldb.com/?ctiid.352018 for updates on patch availability.