CVE-2026-82695: Tenda AC18 Authentication Bypass Vulnerability

CVE-2026-82695 Overview

CVE-2026-82695 is a missing authentication vulnerability [CWE-287] in the Tenda AC18 wireless router running firmware version 15.03.05.19. The flaw resides in the Telnet Handler component, specifically in an unknown function of the /goform/telnet endpoint. An unauthenticated remote attacker can invoke this endpoint to enable or interact with the telnet service without providing credentials. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed devices.

Critical Impact
Unauthenticated remote attackers can reach a privileged telnet interface on affected Tenda AC18 routers, enabling full compromise of device confidentiality, integrity, and availability.

Affected Products

Tenda AC18 router
Firmware version 15.03.05.19
Telnet Handler component exposed at /goform/telnet

Discovery Timeline

2026-08-31 - CVE-2026-82695 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82695

Vulnerability Analysis

The Tenda AC18 web management interface exposes a /goform/telnet endpoint through its embedded HTTP server. This endpoint is handled by the Telnet Handler component, which processes requests intended to control the on-device telnet service. The handler does not validate that the requesting session is authenticated before executing its logic. As a result, any client that can reach the router's management interface can trigger the handler and manipulate the telnet service state.

The attack vector is network-based and requires no user interaction or prior privileges. Where the router's management interface is exposed to untrusted networks, the reachable attack surface is broad. Successful abuse can lead to activation of a privileged shell service, providing an interactive foothold for further post-exploitation actions such as configuration tampering, credential harvesting, or pivoting to other network segments. Detailed technical write-up is published in the GitHub Command Injection Documentation.

Root Cause

The root cause is missing authentication [CWE-287] on a sensitive administrative endpoint. The web server routes requests to /goform/telnet without enforcing a session or credential check inside the Telnet Handler. Sensitive functionality is therefore reachable by anonymous callers.

Attack Vector

An attacker sends a crafted HTTP request to /goform/telnet on the router's management interface. Because the handler bypasses authentication, the request is processed as if it originated from an administrator. The attacker can enable telnet and connect to obtain a shell on the device. See the VulDB CVE-2026-82695 entry for exploit metadata.

No verified proof-of-concept code is available in this dataset. Refer to the linked advisory for request structure and reproduction steps.

Detection Methods for CVE-2026-82695

Indicators of Compromise

HTTP requests from external or unexpected internal sources to the URI path /goform/telnet on Tenda AC18 devices.
Unexpected TCP port 23 (telnet) listeners on routers where telnet was previously disabled.
Successful telnet logins to the router from hosts that do not correspond to administrative workstations.
New or unfamiliar accounts, altered DNS settings, or modified firewall rules on the router configuration.

Detection Strategies

Inspect network traffic for HTTP requests targeting /goform/telnet and alert on any occurrence from non-administrative sources.
Monitor for outbound telnet sessions initiated to or from router management IP addresses.
Correlate router configuration changes with the appearance of new telnet connections in flow logs.

Monitoring Recommendations

Enable syslog forwarding from the Tenda AC18 to a centralized log store and monitor authentication and service state events.
Track port 23 exposure using periodic external and internal scans to identify newly opened telnet services.
Baseline the router's listening ports and alert on deviations, particularly the appearance of telnet after firmware or configuration changes.

How to Mitigate CVE-2026-82695

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative subnets only, and block WAN-side management access.
Disable telnet on the device and verify that TCP port 23 is not listening after the change.
Rotate administrator credentials and any credentials that may have been reused on the router.
Inspect router configuration for unauthorized changes, including DNS servers, port forwards, and remote access settings.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Tenda Official Website for firmware updates addressing the Telnet Handler in AC18 firmware 15.03.05.19, and review the VulDB Vulnerability Details #397183 for updates on remediation status.

Workarounds

Place the router's management interface behind a firewall rule that permits only specific administrative IP addresses.
Segment IoT and network infrastructure devices away from user and server VLANs to limit lateral movement if the device is compromised.
Replace end-of-support or unpatched consumer-grade routers used in business environments with actively maintained equipment.

bash

# Configuration example: block external access to router management and telnet
# Apply on an upstream firewall (syntax varies by platform)
deny tcp any host <router-mgmt-ip> eq 23
deny tcp any host <router-mgmt-ip> eq 80
deny tcp any host <router-mgmt-ip> eq 443
permit tcp <admin-subnet>/24 host <router-mgmt-ip> eq 443