Tenda EUVD-2026-13740

Tenda A18 Pro firmware version 02.03.02.28. Attacker requires authenticated user credentials (PR:L). Remote exploitation via crafted request to /goform/formSetQosBand endpoint manipulating the list parameter to trigger stack buffer overflow in set_qosMib_list function.

This vulnerability presents a high real-world risk due to multiple converging factors. The CVSS score of 8.8 reflects network-based exploitation (AV:N), low attack complexity (AC:L), and high impact across all CIA triad dimensions, requiring only low-level authentication (PR:L) which may be achievable via default or weak credentials common in consumer routers. The Exploit Proof-of-concept maturity indicator (E:P) confirms publicly available exploit code on GitHub, dramatically reducing the skill required for exploitation. While EPSS and KEV status were not provided in the intelligence, the combination of remote exploitability, public exploit availability, and the consumer router attack surface (often poorly maintained and rarely patched) elevates this to a priority issue. The vulnerability is automatable once authentication is achieved, and successful exploitation grants complete device compromise, enabling network pivoting, traffic interception, and persistent access to victim networks.

An attacker on the internet identifies a Tenda A18 Pro router with exposed management interface through automated scanning. Using default or brute-forced credentials to satisfy the low-privilege authentication requirement, the attacker accesses the QoS configuration page and submits a malicious HTTP request to /goform/formSetQosBand with an oversized 'list' parameter crafted using the publicly available GitHub POC exploit (https://github.com/lilukun337/cve/issues/4). The stack buffer overflow overwrites the return address, allowing the attacker to execute shellcode that establishes persistent backdoor access, intercepts all network traffic, or pivots to attack internal network resources.