Cyber Resilience

CVE-2026-31255

CriticalPublic PoCRCE

Published: 27 April 2026

Published
27 April 2026
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0112 62.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-31255 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-31255 is a command injection vulnerability (CWE-77) affecting Tenda AC18 router firmware version V15.03.05.05_multi. The issue resides in the /goform/SetSambaCfg web interface, where improper handling of the guestuser parameter enables attackers to execute arbitrary system commands. Published on 2026-04-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.

The vulnerability can be exploited by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation grants arbitrary command execution on the router's underlying system, compromising confidentiality, integrity, and availability to a high degree.

References providing additional details are available at https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Unauthenticated command injection via public-facing web interface on router enables T1190 exploitation and arbitrary system command execution matching T1059.008 on network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-57583Same product: Tenda Ac18
CVE-2025-11121Same product: Tenda Ac18
CVE-2025-11123Same product: Tenda Ac18
CVE-2024-57581Same product: Tenda Ac18
CVE-2025-11326Same product: Tenda Ac18
CVE-2025-11328Same product: Tenda Ac18
CVE-2024-57582Same product: Tenda Ac18
CVE-2025-11327Same product: Tenda Ac18
CVE-2025-11325Same product: Tenda Ac18
CVE-2024-57579Same product: Tenda Ac18

Affected Assets

tenda
ac18 firmware
15.03.05.05

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by validating the guestuser parameter in the /goform/SetSambaCfg interface to block arbitrary system commands.

SI-9 Information Input Restrictions good match
prevent

Restricts unauthorized or malformed inputs like shell metacharacters in the guestuser parameter to mitigate injection attempts.

SI-2 Flaw Remediation good match
preventrecover

Remediates the specific command injection flaw in Tenda AC18 firmware V15.03.05.05_multi through timely patching and updates.

References