Tenda AC15 routers running firmware V15.03.05.18 expose the goform/formsetUsbUnload endpoint without validating the v1 parameter, allowing attackers to inject shell commands that are executed by the doSystemCmd function. This flaw can be exploited to run arbitrary code, compromise the router, and potentially pivot to other devices on the network, severely impacting confidentiality, integrity, and availability.

The vulnerability affects Tenda AC15 routers with firmware version 15.03.05.18. No other products or revisions are listed as impacted.

Based on the description, the vulnerability carries a CVSS score of 9.8, indicating critical severity, and an EPSS score of 2%, suggesting a measurable but not high probability of exploitation soon. It is not listed in the CISA KEV catalog. Attackers are likely able to exploit it by sending a crafted HTTP POST or GET request to the formsetUsbUnload endpoint, embedding malicious commands in the v1 field. No special privileges are required beyond access to the router’s web interface, making the attack vector relatively straightforward for lateral adversaries.