CVE-2026-31255
Published: 27 April 2026
Summary
CVE-2026-31255 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating the guestuser parameter in the /goform/SetSambaCfg interface to block arbitrary system commands.
Restricts unauthorized or malformed inputs like shell metacharacters in the guestuser parameter to mitigate injection attempts.
Remediates the specific command injection flaw in Tenda AC18 firmware V15.03.05.05_multi through timely patching and updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated command injection via public-facing web interface on router enables T1190 exploitation and arbitrary system command execution matching T1059.008 on network device.
NVD Description
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
Deeper analysisAI
CVE-2026-31255 is a command injection vulnerability (CWE-77) affecting Tenda AC18 router firmware version V15.03.05.05_multi. The issue resides in the /goform/SetSambaCfg web interface, where improper handling of the guestuser parameter enables attackers to execute arbitrary system commands. Published on 2026-04-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
The vulnerability can be exploited by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation grants arbitrary command execution on the router's underlying system, compromising confidentiality, integrity, and availability to a high degree.
References providing additional details are available at https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md.
Details
- CWE(s)