Tenda CVE-2026-4493

Requires authenticated access (PR:L) to Tenda A18 Pro firmware version 02.03.02.28. Attacker must send a crafted request to /goform/setMacFilterCfg endpoint with malicious deviceList parameter to trigger stack-based buffer overflow in MAC Filtering Configuration function.

This vulnerability presents significant real-world risk with multiple concerning indicators. The CVSS score of 8.8 (High) reflects critical characteristics: network-accessible attack vector (AV:N), low attack complexity (AC:L), requires only low privileges (PR:L), no user interaction (UI:N), and full impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The exploit maturity indicator shows proof-of-concept code exists (E:P), confirmed by the public GitHub repository containing working exploit code. The combination of authenticated remote exploitation capability, publicly available exploit code, and impact on consumer IoT infrastructure makes this a realistic threat. While low-privilege authentication is required, many consumer routers use default or weak credentials. The lack of remediation level information (RL:X) suggests no official patch may be available, further elevating risk. This should be considered a genuine priority for organizations and consumers using affected Tenda devices, particularly given the typical internet-facing deployment of routers.

An attacker on the local network or with VPN access authenticates to the Tenda A18 Pro router's web interface using compromised, default, or brute-forced low-privilege credentials. They then craft a malicious HTTP request to /goform/setMacFilterCfg containing an oversized deviceList parameter designed to overflow the stack buffer in function sub_423B50. Using the publicly available proof-of-concept from GitHub (https://github.com/lilukun337/cve/issues/5) as a template, the attacker injects shellcode that executes with the privileges of the web server process, potentially gaining full control of the router to intercept traffic, pivot to internal networks, or establish persistent backdoor access.