Tenda EUVD-2026-19042

Q: What is the CVSS score of EUVD-2026-19042?

EUVD-2026-19042 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-5547 MEDIUM

OS Command Injection (CWE-78)

2026-04-05 VulDB

GHSA-5xr7-9jmx-g4x4

Tenda Command Injection

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 05, 2026 - 07:30 euvd

EUVD-2026-19042

Analysis Generated

Apr 05, 2026 - 07:30 vuln.today

CVE Published

Apr 05, 2026 - 07:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.

AnalysisAI

OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arbitrary system commands via the formAddMacfilterRule function in /bin/httpd. The vulnerability requires valid credentials (PR:L in CVSS vector) and affects multiple endpoints related to MAC filtering configuration. No public exploit code has been independently confirmed as actively exploited, though proof-of-concept documentation exists in public repositories.

Technical ContextAI

The vulnerability exists in the HTTP daemon (/bin/httpd) of Tenda AC10 wireless router firmware, specifically in the formAddMacfilterRule function responsible for handling MAC address filtering rule additions. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates insufficient input validation or output encoding of user-supplied parameters before passing them to OS command execution functions. Tenda AC10 is a consumer-grade dual-band WiFi router; the httpd service typically runs with elevated privileges, making command injection highly impactful. The CPE cpe:2.3:a:tenda:ac10:*:*:*:*:*:*:*:* indicates all versions of the AC10 product line may be affected, though the specific vulnerable version identified is 16.03.10.10_multi_TDE01.

RemediationAI

Upgrade Tenda AC10 firmware to a patched version released by Tenda. Exact patched firmware version numbers are not specified in available data; users should check Tenda's official support portal (https://www.tenda.com.cn/) for the latest firmware release and security advisories for the AC10 model. As an interim mitigation, restrict access to the router's web management interface to trusted networks only, disable remote management if not required, and enforce strong credentials for administrative accounts. Additional technical details and proof-of-concept information are documented at https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-03-command-injection-formaddmacfilterrule.md and https://vuldb.com/vuln/355311.