EUVD-2026-68509
GHSA-q8vr-4mj7-wm6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend unauthenticated request to /goform/telnet
-
ExploitBypass missing authentication, enable telnet
-
ExecutionConnect to exposed telnet service
-
ImpactObtain root shell, full device control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda AC18 web management service and the ability to send a request to the /goform/telnet Telnet Handler endpoint; per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special attack requirements are needed against firmware 15.03.05.19. The chief limiting factor is exposure scope: if the HTTP admin interface is only reachable on the LAN/Wi-Fi (the common default, with WAN/remote management off), an attacker must first be on the local network, whereas routers with remote management enabled are exploitable directly from the Internet. Affected version is limited to the AC18 running 15.03.05.19 as reported. |
| Impact | All raw severity signals point high: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact to both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), yielding 9.3, and the exploit-maturity metric is E:P (proof-of-concept). Publicly available exploit code raises operational risk, but there is no CISA KEV entry and no EPSS score supplied, so this is best treated as 'publicly available exploit code exists' rather than confirmed active exploitation. The primary caveat is source diversity: the finding originates solely from VulDB (a single reporter/PoC), with no independent vendor advisory, so affected-version breadth and the subsequent-system scope claim (SC/SI/SA:H) should be verified. Net assessment: for anyone operating an AC18, this is a high-priority, network-reachable full-compromise issue; the main uncertainty is prevalence and whether exposure is Internet-facing versus LAN-only. |
| Exploit ScenarioDerived | An attacker who can reach the router's HTTP management interface (e.g., a router with remote management enabled, or an attacker already on the LAN/Wi-Fi) sends a crafted request to /goform/telnet, which requires no authentication and activates or exposes the telnet service. The attacker then connects over telnet to obtain a root-level shell on the device. A public PoC/exploit is already available, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 31, 2026
Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.
Earlier versions of this analysis (1)
Authentication bypass in the Tenda AC18 (firmware 15.03.05.19) router allows remote attackers to invoke the /goform/telnet endpoint of the Telnet Handler without any credentials, enabling the telnet service and yielding full device control. Publicly available exploit code exists (published via VulDB), though there is no public exploit identified as actively used in the wild. The issue is a classic missing-authentication flaw (CWE-306) on a consumer/SOHO router web interface.
RemediationAI
No vendor-released patch identified at time of analysis; check https://www.tenda.com.cn/ for updated AC18 firmware superseding 15.03.05.19 and apply it once published. As compensating controls, ensure the router's web/remote management and any WAN-side telnet exposure are disabled so /goform/telnet is unreachable from the Internet - this closes the remote attack path with minimal usability cost. Restrict management to a trusted wired VLAN or specific admin hosts via ACLs, and block inbound TCP/23 (telnet) plus the HTTP admin port at any upstream firewall (side effect: local admins must connect from the permitted segment). Where feasible, replace the end-of-support-prone consumer device with a router that receives security updates. Track the VulDB record at https://vuldb.com/vuln/397183 for a fixed-version reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda AC18 is a consumer/SOHO dual-band Wi-Fi router whose web management stack exposes /goform/* handlers backed by the device's httpd/goahead-style CGI framework. The vulnerable /goform/telnet handler manages the on-device telnet daemon (typically busybox telnetd) but performs no session or credential check before acting, matching CWE-306 (Missing Authentication for a Critical Function). Because telnet grants an interactive shell on the embedded Linux firmware, an unauthenticated request that toggles or reaches this handler effectively hands an attacker administrative command execution on the router. CPE cpe:2.3:a:tenda:ac18:*:*:*:*:*:*:*:* identifies the affected product, with the reporter (VulDB) pinning firmware 15.03.05.19.
Know when Ac18 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated network request to /goform/telnet bypasses auth (PR:N, AC:L) and yields root shell, giving full C/I/A; impact stays on the router so S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Technical POC Analysis
The vulnerability is CWE-306 Missing Authentication for Critical Function.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Tenda AC18 router (firmware 15.03.05.19) contains a critical vulnerability (CVE-2026-82695, CVSS 9.3) enabling unauthenticated remote attackers to gain complete control of network devices via an exposed telnet service. Publicly available exploit code exists for this flaw. Affected organizations face direct compromise of their network perimeter, enabling attackers to intercept traffic, exfiltrate data, and pivot to internal systems-with no vendor patch currently available to address the exposure.
No vendor-released patch identified at time of analysis. Implement interim controls: (1) Firewall rules denying all inbound connections to TCP port 23 and the /goform/telnet endpoint; (2) IP-based access restrictions limiting router management access to authorized administrative subnets only; (3) Network segmentation isolating affected routers on a dedicated management VLAN with firewall separation from production networks; (4) Intrusion detection monitoring configured to alert on unexpected telnet connection attempts; (5) Active inventory tracking affected device locations and serial numbers to ensure complete replacement coverage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB