CVE-2026-31255
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.
Published Apr 27, 2026 · updated Jun 17, 2026 · tenda ac18 firmware
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 27, 2026 · NIST NVD
Detected
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
Jun 17, 2026 · NIST NVD
Updated
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
Affected
- cpe tenda/ac18 firmware15.03.05.05
Sources
- CVE.orgVulnerability recordCVE-2026-31255
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-31255
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
nvd.nist.gov