EUVD-2026-13729Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Tenda A18 Pro web interface
-
ExploitSend crafted request to /goform/fast_setting_wifi_set
-
ExecutionOverflow stack buffer in form_fast_setting_wifi_set function
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Tenda A18 Pro firmware version 02.03.02.28. Requires authenticated access (PR:L); attacker must have valid login credentials. Remote exploitation via POST request to /goform/fast_setting_wifi_set endpoint. No victim interaction needed. |
| Impact | This vulnerability presents significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS score of 8.8 reflects high impact across all CIA triad components with network-based attack vector (AV:N) and low attack complexity (AC:L). The availability of a public proof-of-concept exploit on GitHub substantially increases exploitation likelihood, as attackers can leverage existing code rather than developing exploits from scratch. While the vulnerability requires authentication, home and small office routers often retain default credentials or use weak passwords, making the PR:L requirement a minimal barrier. The combination of network accessibility, low complexity, public exploit code, and router context (24/7 internet-facing devices with inconsistent patching) elevates this from a theoretical high-CVSS issue to a genuine exploitation concern. Organizations and home users with affected devices should prioritize remediation. |
| Exploit ScenarioDerived | An attacker on the local network or who has obtained low-privilege credentials to the router's web interface (through credential stuffing, default passwords, or previous compromise) sends a specially crafted HTTP request to the /goform/fast_setting_wifi_set endpoint with malicious payload data designed to overflow the stack buffer in form_fast_setting_wifi_set. Using techniques documented in the public proof-of-concept on GitHub, the attacker overwrites the return address on the stack to redirect execution to injected shellcode, gaining full control of the router to intercept traffic, modify DNS settings, establish persistent backdoors, or pivot to attack other devices on the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Stack-based buffer overflow in Tenda A18 Pro firmware version 02.03.02.28 allows authenticated remote attackers to achieve complete system compromise through the /goform/fast_setting_wifi_set endpoint. Public exploit code is available and actively being weaponized against this unpatched vulnerability. Attackers with network access and valid credentials can execute arbitrary code with full system privileges.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set endpoint in Tenda A18 Pro router firmware version 02.03.02.28. An authenticated remote attacker can exploit this vulnerability to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation.
RemediationAI
Users should immediately check the Tenda website at https://www.tenda.com.cn/ for updated firmware releases addressing this vulnerability and upgrade to the latest available version as soon as possible. Until patching is completed, implement network-level mitigations including disabling remote administration access to the router's web interface, restricting management interface access to trusted internal IP addresses only, changing default credentials to strong unique passwords, and placing the router behind additional firewall protection if possible. Organizations should consider replacing affected devices if Tenda does not release a security patch within a reasonable timeframe, as end-of-life or poorly supported consumer networking equipment poses ongoing security risks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Tenda A18 Pro wireless router (CPE: cpe:2.3:a:tenda:a18_pro:*:*:*:*:*:*:*:*) running firmware version 02.03.02.28. The root cause is a CWE-121 stack-based buffer overflow in the form_fast_setting_wifi_set function, which handles WiFi configuration through the /goform/fast_setting_wifi_set endpoint. Stack-based buffer overflows occur when data is written beyond the boundaries of a fixed-size buffer allocated on the stack, potentially overwriting adjacent memory including return addresses and control flow data. This class of vulnerability can lead to arbitrary code execution as attackers can hijack program execution by carefully crafting malicious input that overwrites critical stack data.
Know when Tenda gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
Executive ViewAI
A critical remote code execution vulnerability affects Tenda A18 Pro routers (firmware 02.03.02.28) that allows authenticated attackers to gain complete control of affected devices. With public exploits readily available and no vendor patch currently released, any organization deploying this router model faces immediate risk of network compromise, data theft, and potential lateral movement into connected systems.
Implement network segmentation to isolate Tenda routers from critical infrastructure; enforce strong authentication with account lockout policies; deploy WAF rules to restrict /goform/fast_setting_wifi_set endpoint access to trusted IPs only; disable the fast_setting_wifi_set function if not operationally required; monitor for exploitation attempts via IDS/IPS signatures; restrict router administrative interfaces to dedicated management VLANs; conduct daily vulnerability scanning and log aggregation for breach detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in Tenda A18 Pro Buffer Overflow Vulnerabilities
View all 3Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. Rated high sev
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attacke
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. Rated critic
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. Rated critical severity (CV
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. Rated critical se
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. Rate
Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /
Certain Tenda products are vulnerable to command injection. Rated critical severity (CVSS 9.8), this vulnerability is re
Exploit-DB