CVE-2026-31255: Tenda AC18 Firmware RCE Vulnerability

CVE-2026-31255 Overview

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi firmware. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands. This flaw enables unauthenticated remote attackers to gain complete control over the affected router device.

Critical Impact

This command injection vulnerability allows unauthenticated attackers to execute arbitrary system commands on vulnerable Tenda AC18 routers via network access, potentially leading to complete device compromise, network pivoting, and persistent backdoor installation.

Affected Products

• Tenda AC18 Firmware version 15.03.05.05_multi
• Tenda AC18 hardware devices running the vulnerable firmware
• All Tenda AC18 devices with the /goform/SetSambaCfg interface exposed

Discovery Timeline

• 2026-04-27 - CVE-2026-31255 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31255

Vulnerability Analysis

This vulnerability stems from improper input validation in the Samba configuration interface of the Tenda AC18 router. The /goform/SetSambaCfg endpoint processes the guestuser parameter without adequate sanitization, allowing command injection through specially crafted HTTP requests. The affected firmware constructs system commands using user-supplied input, which when not properly escaped or validated, permits attackers to inject arbitrary shell commands that execute with the privileges of the web service process—typically root on embedded devices.

The vulnerability is classified under CWE-77 (Command Injection), indicating that user-controlled input is incorporated into commands executed by the system without proper neutralization of special characters. Successful exploitation requires no authentication, making this vulnerability particularly dangerous for devices exposed to the network.

Root Cause

The root cause is the failure to properly sanitize the guestuser parameter before incorporating it into system commands within the /goform/SetSambaCfg handler. The firmware lacks input validation routines to filter or escape shell metacharacters such as semicolons (;), pipes (|), backticks (`), and other command separators. This allows attackers to break out of the intended command context and execute arbitrary commands.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious HTTP POST request to the /goform/SetSambaCfg endpoint with a crafted guestuser parameter containing shell metacharacters followed by malicious commands. The injected commands execute in the context of the web server process, which typically runs with elevated privileges on embedded router devices.

Common attack scenarios include:

• Injecting commands to establish a reverse shell connection
• Modifying DNS settings to redirect traffic
• Installing persistent malware or backdoors
• Pivoting to attack other devices on the network
• Exfiltrating configuration data including wireless credentials

For technical details on the exploitation mechanism, refer to the GitHub CVE References for Tenda AC18.

Detection Methods for CVE-2026-31255

Indicators of Compromise

• Unexpected outbound connections from the router to unknown IP addresses
• Unusual processes running on the device or abnormal CPU/memory usage
• Modified configuration files or unauthorized changes to Samba settings
• HTTP POST requests to /goform/SetSambaCfg containing shell metacharacters in the guestuser parameter
• Evidence of command execution artifacts in router logs or file system

Detection Strategies

• Implement network monitoring to detect HTTP POST requests to /goform/SetSambaCfg containing suspicious characters such as ;, |, &&, `, or $()
• Deploy intrusion detection signatures targeting command injection patterns in router management interfaces
• Monitor for unusual network traffic patterns originating from router devices, particularly reverse shell connections
• Implement web application firewall rules to block requests with shell metacharacters in form parameters

Monitoring Recommendations

• Enable and regularly review router access logs for unauthorized configuration change attempts
• Monitor network traffic for connections to known malicious infrastructure
• Implement alerting for any firmware modification attempts or unusual system calls on the device
• Periodically verify router configuration integrity against known-good baselines

How to Mitigate CVE-2026-31255

Immediate Actions Required

• Restrict network access to the router management interface to trusted IP addresses only
• Disable remote management features if not required
• Place the router behind a firewall and block external access to the web management interface
• Consider network segmentation to isolate affected devices until patches are available
• Monitor the device for signs of compromise and be prepared to factory reset if necessary

Patch Information

At the time of publication, no vendor patch information has been provided by Tenda for this vulnerability. Organizations should monitor official Tenda channels for firmware updates that address CVE-2026-31255. For additional technical details, consult the GitHub CVE References for Tenda AC18.

Workarounds

• Disable the Samba/file sharing functionality on the router if not required for operations
• Configure firewall rules to block access to the /goform/SetSambaCfg endpoint from untrusted networks
• Limit management interface access to a dedicated management VLAN with strict access controls
• Consider replacing affected devices with alternative router hardware from vendors with better security track records

# Example: Block access to vulnerable endpoint using iptables on upstream firewall
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -m string --string "/goform/SetSambaCfg" --algo bm -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -m string --string "/goform/SetSambaCfg" --algo bm -j DROP