CVE-2026-31255 - Vulnerability Analysis

Overview

Tenda AC18 V15.03.05.05_multi contains a command injection caused by improper handling of the guestuser parameter in /goform/SetSambaCfg, letting attackers execute arbitrary system commands remotely, exploit requires network access.

Severity & Score

Impact

Attackers can execute arbitrary system commands, potentially leading to full system compromise.

Mitigation

Update to the latest version or vendor-provided patch addressing this vulnerability.

References

• https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/Tenda_AC18/Tenda_AC18_3th/README.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner