The vulnerability originates from improper handling of the guestuser parameter in the /goform/SetSambaCfg interface, allowing command injection. This weakness can be exploited to execute arbitrary system commands, giving an attacker full control over the device. It aligns with CWE-77, and jeopardizes confidentiality, integrity, and availability.

The affected product is a Tenda AC18 router running firmware version V15.03.05.05_multi. No other vendors, products, or versions are listed in the CVE record.

The CVSS score of 5.4 and an EPSS score of < 1% indicate a moderate vulnerability with a low but non-zero likelihood of exploitation. The likely attack vector is access to the router’s web administration interface, reachable from the local network. Because the flaw permits arbitrary command execution, the potential risk is high, especially if an attacker can reach the interface from within the network or from a compromised device. The vulnerability is not listed in the CISA KEV catalog.