Cyber Posture

CVE-2026-31255

CriticalPublic PoC

Published: 27 April 2026

Published
27 April 2026
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by validating the guestuser parameter in the /goform/SetSambaCfg interface to block arbitrary system commands.

SI-9 Information Input Restrictions good match
prevent

Restricts unauthorized or malformed inputs like shell metacharacters in the guestuser parameter to mitigate injection attempts.

SI-2 Flaw Remediation good match
preventrecover

Remediates the specific command injection flaw in Tenda AC18 firmware V15.03.05.05_multi through timely patching and updates.

Security SummaryAI

CVE-2026-31255 is a command injection vulnerability (CWE-77) affecting Tenda AC18 router firmware version V15.03.05.05_multi. The issue resides in the /goform/SetSambaCfg web interface, where improper handling of the guestuser parameter enables attackers to execute arbitrary system commands. Published on 2026-04-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.

The vulnerability can be exploited by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation grants arbitrary command execution on the router's underlying system, compromising confidentiality, integrity, and availability to a high degree.

References providing additional details are available at https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md.

Details

CWE(s)
CWE-77

Affected Products

tenda
ac18 firmware
15.03.05.05

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Unauthenticated command injection via public-facing web interface on router enables T1190 exploitation and arbitrary system command execution matching T1059.008 on network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References