{"id":"CVE-2026-129258","kind":"vulnerability","aliases":["CVE-2026-129258"],"related":[],"title":"Tenda AC18 router: firmware upgrade handler accepts unverified firmware files","description":"A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.","summary":"The Tenda AC18 router's firmware upgrade handler at /cgi-bin/upgrade does not properly verify the authenticity of the uploaded upgradeFile argument. A remote attacker can exploit this, and a public exploit exists, which may let them tamper with the device's firmware.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tenda AC18","fixed":[],"affected":"15.03.05.05_multi, 15.03.05.19 Build 6318","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ac18","auth-required","firmware","home-router","infrastructure","router","tenda"],"not_affected_if":["auth-required","other-firmware-versions"],"how_to_check":"- Admin web interface > System status/firmware version: compare with 15.03.05.05_multi and 15.03.05.19 Build 6318.\n- Check whether the admin interface is reachable from the WAN (remote web management enabled) and that the admin password is not default.\n- Also check other AC18 builds if you run them; the sources do not say whether they are affected.","fix":"No fixed firmware is published as far as the sources show; VulDB lists no countermeasure. Tenda's own page was not found. Until then: disable remote/WAN admin, set a strong admin password, and consider replacing the device.","status":"open","published_at":"2026-11-14T15:16:58+00:00","first_seen_at":"2026-11-14T15:29:35+00:00","triaged_at":"2026-11-14T15:31:05+00:00","updated_at":"2026-11-14T15:32:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-14T15:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Tenda AC18 router: firmware upgrade handler accepts unverified firmware files","impact":"high","summary":"The Tenda AC18 router's firmware upgrade handler at /cgi-bin/upgrade does not properly verify the authenticity of the uploaded upgradeFile argument. A remote attacker can exploit this, and a public exploit exists, which may let them tamper with the device's firmware.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["tenda","ac18","router","firmware","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker may tamper with router firmware upgrade","analyst_note":"Confirm the fixed firmware version and whether authentication is required for /cgi-bin/upgrade on the Tenda vendor site or NVD.","how_to_check":"- Check the router's firmware version in the admin web interface and compare it with `15.03.05.05_multi` or `15.03.05.19 Build 6318`\n- Confirm whether the router's admin interface is reachable from the internet\n- unknown for a vendor-specific file path check, as the sources do not say","plain_action":"Check your Tenda AC18 router's firmware version and watch for an update from Tenda; the sources do not name a fixed version.","product_name":"Tenda AC18","needs_analyst":true,"not_affected_if":["other-firmware-versions"],"who_is_affected":"Owners of Tenda AC18 routers running firmware 15.03.05.05_multi or 15.03.05.19 Build 6318 are exposed, especially if the web admin interface is reachable from outside the home or office network. The sources do not say whether default settings are vulnerable, so treat any exposed device as at risk. Devices not running these firmware builds are not covered by this entry.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000809,"input_tokens":4607,"output_tokens":697,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether authentication is required for /cgi-bin/upgrade on the Tenda vendor site or NVD.","search":"'-129258':13A,16A '-2026':12A,15A '/cgi-bin/upgrade':39B,94C '15.03.05.05':79C '6318':82C 'ac18':2A,18A,19B,32B,78C 'accept':7A 'affect':83C 'argument':50B,105C 'attack':53B,115C 'auth':21B 'auth-requir':20B 'authent':45B,113C 'avail':124C 'build':81C 'compon':97C 'cve':11A,14A 'data':112C 'devic':69B 'exist':61B 'exploit':55B,60B,121C 'file':10A,93C 'firmwar':4A,9A,23B,35B,71B,98C 'function':90C 'handler':6A,37B,100C 'home':25B 'home-rout':24B 'identifi':75C 'infrastructur':27B 'insuffici':109C 'launch':118C 'lead':107C 'let':64B 'manipul':102C 'may':63B,116C 'might':126C 'multi/15.03.05.19':80C 'proper':42B 'public':59B,123C 'remot':52B,119C 'requir':22B 'router':3A,26B,28B,33B 'tamper':66B 'tenda':1A,17A,29B,31B,77C 'unknown':89C 'unverifi':8A 'upgrad':5A,36B,99C 'upgradefil':49B,106C 'upload':48B 'use':128C 'verif':110C 'verifi':43B 'vulner':73C,86C","nicknames":[],"mitigations":[],"who_affected":"Owners of Tenda AC18 (AC18V1.0BR) routers running firmware V15.03.05.05_multi or V15.03.05.19 Build 6318. VulDB says the attack can be launched remotely but needs an authenticated (elevated-privilege) session, so the risk is highest when the admin interface is reachable from the internet or the admin password is weak or default. Other firmware builds are not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you have a Tenda AC18 router, turn off remote management in its settings, use a strong admin password, and install a firmware update from Tenda when one appears.","pkeys":["ac18","tendaac18"],"ptokens":["ac18","tenda"],"labels":["ac18","authrequired","critical","firmware","homerouter","infrastructure","router","tenda","vendor"],"campaign_type":null,"search_a":"'-129258':13A,16A '-2026':12A,15A 'ac18':2A,18A 'accept':7A 'cve':11A,14A 'file':10A 'firmwar':4A,9A 'handler':6A 'router':3A 'tenda':1A,17A 'unverifi':8A 'upgrad':5A","search_b":"'/cgi-bin/upgrade':39B 'ac18':19B,32B 'argument':50B 'attack':53B 'auth':21B 'auth-requir':20B 'authent':45B 'devic':69B 'exist':61B 'exploit':55B,60B 'firmwar':23B,35B,71B 'handler':37B 'home':25B 'home-rout':24B 'infrastructur':27B 'let':64B 'may':63B 'proper':42B 'public':59B 'remot':52B 'requir':22B 'router':26B,28B,33B 'tamper':66B 'tenda':29B,31B 'upgrad':36B 'upgradefil':49B 'upload':48B 'verifi':43B","search_c":"'/cgi-bin/upgrade':94C '15.03.05.05':79C '6318':82C 'ac18':78C 'affect':83C 'argument':105C 'attack':115C 'authent':113C 'avail':124C 'build':81C 'compon':97C 'data':112C 'exploit':121C 'file':93C 'firmwar':98C 'function':90C 'handler':100C 'identifi':75C 'insuffici':109C 'launch':118C 'lead':107C 'manipul':102C 'may':116C 'might':126C 'multi/15.03.05.19':80C 'public':123C 'remot':119C 'tenda':77C 'unknown':89C 'upgrad':99C 'upgradefil':106C 'use':128C 'verif':110C 'vulner':73C,86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T15:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129258","severity":null,"published_at":"2026-11-14T15:16:58+00:00","modified_at":"2026-11-14T15:16:58+00:00","first_seen_at":"2026-11-14T15:29:35+00:00","fetched_at":"2026-11-14T15:29:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129258:3988","url":"https://vuldb.com/vuln/437295","severity":null,"published_at":"2026-11-14T15:32:31+00:00","modified_at":"2026-11-14T15:32:31+00:00","first_seen_at":"2026-11-14T15:32:31+00:00","fetched_at":"2026-11-14T15:32:31+00:00","note":"Only VulDB (CNA) source found; no Tenda advisory or fix. VulDB: PoC public on GitHub, exploitation requires authentication (CVSS PR:H). Not exploited per sources. Nothing verified since no vendor page.","cites":["https://vuldb.com/vuln/437295"]}],"documents":[{"id":156555,"url":"https://vuldb.com/vuln/437295","title":"VulDB VDB-437295: Tenda AC18 /cgi-bin/upgrade upgradeFile data authenticity","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}