CVE-2026-129258

Tenda AC18 Firmware Upgrade upgrade data authenticity

View on CVE.org
Published Nov 14, 2026 CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Description
A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A vulnerability in the Tenda AC18 firmware upgrade handler allows an attacker to supply a malformed upgradeFile parameter to the /cgi-bin/upgrade endpoint, bypassing the authenticity check. This weakness permits a remote attacker to upload and install arbitrary firmware, effectively gaining full control over the device. The flaw is identified as a missing or incomplete data authenticity verification, which is catalogued as CWE‑345.

Affected Systems

Tenda AC18 devices running firmware versions 15.03.05.05_multi or 15.03.05.19 Build 6318 are affected. The issue resides in the firmware upgrade component reachable at /cgi-bin/upgrade and is specific to this publicly sold router model.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.4, indicating a critical severity. Exploit code is publicly available and can be launched from any network location with access to the device’s upgrade interface, although the EPSS score is currently not published. It is not listed in the CISA KEV catalog, but the high CVSS rating and remote launchability make the potential for widespread exploitation significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update that restores proper authenticity checks on firmware uploads
  • Disable or restrict remote upgrade functionality, limiting access to trusted IP ranges or disabling the feature entirely if not required
  • Verify firmware binaries manually before upload, ensuring they are signed and match vendor‑provided checksums to prevent the installation of tampered firmware

Generated by OpenCVE AI on November 14, 2026 at 19:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tenda ac18
Vendors & Products Tenda ac18
Type Values Removed Values Added
Description A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.
Title Tenda AC18 Firmware Upgrade upgrade data authenticity
First Time appeared Tenda
Tenda ac18 Firmware
Weaknesses CWE-345
CPEs cpe:2.3:o:tenda:ac18_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda ac18 Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 14, 2026, 2:30 PM
Reserved
Nov 13, 2026, 7:57 PM

View source JSON

No data.

Status
Deferred
Published
Nov 14, 2026, 3:16 PM
Modified
Nov 14, 2026, 3:16 PM

View source JSON

No data.

Updated
Nov 14, 2026, 4:00 PM

JSON