CVE-2026-31255: Tenda AC18 Firmware RCE Vulnerability

CVE-2026-31255 Overview

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi firmware. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands. This flaw enables unauthenticated remote attackers to gain complete control over the affected router device.

Critical Impact
This command injection vulnerability allows unauthenticated attackers to execute arbitrary system commands on vulnerable Tenda AC18 routers via network access, potentially leading to complete device compromise, network pivoting, and persistent backdoor installation.

Affected Products

Tenda AC18 Firmware version 15.03.05.05_multi
Tenda AC18 hardware devices running the vulnerable firmware
All Tenda AC18 devices with the /goform/SetSambaCfg interface exposed

Discovery Timeline

2026-04-27 - CVE-2026-31255 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31255

Vulnerability Analysis

This vulnerability stems from improper input validation in the Samba configuration interface of the Tenda AC18 router. The /goform/SetSambaCfg endpoint processes the guestuser parameter without adequate sanitization, allowing command injection through specially crafted HTTP requests. The affected firmware constructs system commands using user-supplied input, which when not properly escaped or validated, permits attackers to inject arbitrary shell commands that execute with the privileges of the web service process—typically root on embedded devices.

The vulnerability is classified under CWE-77 (Command Injection), indicating that user-controlled input is incorporated into commands executed by the system without proper neutralization of special characters. Successful exploitation requires no authentication, making this vulnerability particularly dangerous for devices exposed to the network.

Root Cause

The root cause is the failure to properly sanitize the guestuser parameter before incorporating it into system commands within the /goform/SetSambaCfg handler. The firmware lacks input validation routines to filter or escape shell metacharacters such as semicolons (;), pipes (|), backticks (`), and other command separators. This allows attackers to break out of the intended command context and execute arbitrary commands.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious HTTP POST request to the /goform/SetSambaCfg endpoint with a crafted guestuser parameter containing shell metacharacters followed by malicious commands. The injected commands execute in the context of the web server process, which typically runs with elevated privileges on embedded router devices.

Common attack scenarios include:

Injecting commands to establish a reverse shell connection
Modifying DNS settings to redirect traffic
Installing persistent malware or backdoors
Pivoting to attack other devices on the network
Exfiltrating configuration data including wireless credentials

For technical details on the exploitation mechanism, refer to the GitHub CVE References for Tenda AC18.

Detection Methods for CVE-2026-31255

Indicators of Compromise

Unexpected outbound connections from the router to unknown IP addresses
Unusual processes running on the device or abnormal CPU/memory usage
Modified configuration files or unauthorized changes to Samba settings
HTTP POST requests to /goform/SetSambaCfg containing shell metacharacters in the guestuser parameter
Evidence of command execution artifacts in router logs or file system

Detection Strategies

Implement network monitoring to detect HTTP POST requests to /goform/SetSambaCfg containing suspicious characters such as ;, |, &&, `, or $()
Deploy intrusion detection signatures targeting command injection patterns in router management interfaces
Monitor for unusual network traffic patterns originating from router devices, particularly reverse shell connections
Implement web application firewall rules to block requests with shell metacharacters in form parameters

Monitoring Recommendations

Enable and regularly review router access logs for unauthorized configuration change attempts
Monitor network traffic for connections to known malicious infrastructure
Implement alerting for any firmware modification attempts or unusual system calls on the device
Periodically verify router configuration integrity against known-good baselines

How to Mitigate CVE-2026-31255

Immediate Actions Required

Restrict network access to the router management interface to trusted IP addresses only
Disable remote management features if not required
Place the router behind a firewall and block external access to the web management interface
Consider network segmentation to isolate affected devices until patches are available
Monitor the device for signs of compromise and be prepared to factory reset if necessary

Patch Information

At the time of publication, no vendor patch information has been provided by Tenda for this vulnerability. Organizations should monitor official Tenda channels for firmware updates that address CVE-2026-31255. For additional technical details, consult the GitHub CVE References for Tenda AC18.

Workarounds

Disable the Samba/file sharing functionality on the router if not required for operations
Configure firewall rules to block access to the /goform/SetSambaCfg endpoint from untrusted networks
Limit management interface access to a dedicated management VLAN with strict access controls
Consider replacing affected devices with alternative router hardware from vendors with better security track records

bash

# Example: Block access to vulnerable endpoint using iptables on upstream firewall
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -m string --string "/goform/SetSambaCfg" --algo bm -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -m string --string "/goform/SetSambaCfg" --algo bm -j DROP