Which versions of Tenda are affected by CVE-2026-4493?

A critical remote code execution vulnerability (CVE-2026-4493) affects Tenda A18 Pro routers, allowing authenticated attackers to gain complete control of affected devices.

Is there a public PoC exploit available for CVE-2026-4493?

Yes, a public proof-of-concept exploit is available for CVE-2026-4493. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4493?

Within 24 hours: Inventory all Tenda A18 Pro routers in your environment and isolate firmware version 02.03.02.28 devices from production networks if possible. Within 7 days: Implement network segmentation to restrict administrative access to the MAC Filtering Configuration endpoint and monitor for suspicious authentication attempts. Within 30 days: Replace affected devices with patched firmware once available from Tenda, or substitute with alternative router models from vendors with active security support.

Tenda CVE-2026-4493

Q: What is the CVSS score of CVE-2026-4493?

CVE-2026-4493 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13754 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-20 VulDB

Buffer Overflow Stack Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Apr 22, 2026 - 21:37 NVD

8.8 (HIGH) 7.4 (HIGH)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 17:45 euvd

EUVD-2026-13754

Analysis Generated

Mar 20, 2026 - 17:45 vuln.today

CVE Published

Mar 20, 2026 - 17:32 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was determined in Tenda A18 Pro 02.03.02.28. The impacted element is the function sub_423B50 of the file /goform/setMacFilterCfg of the component MAC Filtering Configuration Endpoint. Executing a manipulation of the argument deviceList can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in Tenda A18 Pro MAC filtering configuration allows remote authenticated attackers to achieve full system compromise through manipulation of the deviceList parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw impacts the /goform/setMacFilterCfg endpoint with a CVSS score of 8.8.

Technical ContextAI

This vulnerability affects the Tenda A18 Pro wireless router (CPE: cpe:2.3:a:tenda:a18_pro) running firmware version 02.03.02.28. The issue is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the MAC address filtering configuration module. When processing MAC address device lists through the web management interface endpoint /goform/setMacFilterCfg, the function sub_423B50 fails to properly validate input length before copying data to a fixed-size stack buffer. This classic memory corruption vulnerability allows an attacker to overwrite adjacent memory regions on the stack, potentially including return addresses and function pointers, leading to arbitrary code execution within the context of the router's web server process.

RemediationAI

Check the official Tenda website (https://www.tenda.com.cn/) and contact Tenda support for firmware updates addressing this vulnerability, as no specific patched version has been publicly announced based on available references. Until an official patch is available, implement network-level mitigations: disable remote administration access to the router's web interface, restrict management interface access to trusted internal IP addresses only, change default administrative credentials to strong unique passwords, and consider deploying the router behind additional network segmentation or firewall rules. Organizations should also disable MAC address filtering if not operationally required, as this removes the vulnerable attack surface entirely. Monitor VulDB tracking pages (https://vuldb.com/?id.352019) for updates on patch availability.