Tenda A18 CVE-2026-51934

Exploitation requires network reachability to the Tenda A18's HTTP management service and the ability to send a request invoking the fromSetCmdlineRun function on firmware v15.13.07.09; per CVSS PR:N/UI:N no credentials or user interaction are needed. The primary limiting factor is exposure of that web interface: attack is straightforward if management is reachable from the attacker's network segment or the WAN, but is confined to LAN/adjacent attackers when the interface is only bound to the internal network. Exploitation is also specific to this device model and the stated firmware build.

The signals point to a genuinely high-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes trivially reachable, unauthenticated RCE, and the referenced GitHub repository suggests exploit details are public. Tempering that, EPSS is only 0.30% (22nd percentile) and there is no CISA KEV entry, so mass exploitation is not currently evidenced - this is common for individual SOHO-router CVEs that are technically severe but tracked in bulk. Realistic exposure hinges on whether the vulnerable web interface is reachable from the WAN or only the LAN; internet-exposed management dramatically raises risk, while LAN-only exposure narrows it to local/adjacent attackers, and any operator running an internet-facing Tenda A18 should treat patching or network isolation as urgent. Overall this is a real priority for anyone operating this specific device, weighted by exposure rather than by broad exploitation telemetry.

An attacker who can reach the router's HTTP management interface sends a crafted request to the fromSetCmdlineRun handler with an oversized parameter that overflows a fixed buffer, overwriting control-flow data to execute attacker-supplied code as the web server process. Because no authentication or user interaction is required, this can be scripted against exposed devices, and the referenced GitHub repository likely provides a working proof of concept.