---
id: "CVE-2026-129258"
page: "https://infrastack.ai/live/CVE-2026-129258"
kind: "vulnerability"
aliases: ["CVE-2026-129258"]
title: "Tenda AC18 router: firmware upgrade handler accepts unverified firmware files"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Tenda AC18", "fixed": [], "affected": "15.03.05.05_multi, 15.03.05.19 Build 6318", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ac18", "auth-required", "firmware", "home-router", "infrastructure", "router", "tenda"]
not_affected_if: ["auth-required", "other-firmware-versions"]
published_at: "2026-11-14T15:16:58+00:00"
first_seen_at: "2026-11-14T15:29:35+00:00"
updated_at: "2026-11-14T15:32:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129258", "first_seen_at": "2026-11-14T15:29:35+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/437295", "first_seen_at": "2026-11-14T15:32:31+00:00", "cites": ["https://vuldb.com/vuln/437295"]}]
exploit_sources: []
---

# Tenda AC18 router: firmware upgrade handler accepts unverified firmware files

Link for people: https://infrastack.ai/live/CVE-2026-129258 (this .md is for agents)

The Tenda AC18 router's firmware upgrade handler at /cgi-bin/upgrade does not properly verify the authenticity of the uploaded upgradeFile argument. A remote attacker can exploit this, and a public exploit exists, which may let them tamper with the device's firmware.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tenda AC18 affected 15.03.05.05_multi, 15.03.05.19 Build 6318 fixed no fixed version listed

## How to check

- Admin web interface > System status/firmware version: compare with 15.03.05.05_multi and 15.03.05.19 Build 6318.
- Check whether the admin interface is reachable from the WAN (remote web management enabled) and that the admin password is not default.
- Also check other AC18 builds if you run them; the sources do not say whether they are affected.

## Fix

No fixed firmware is published as far as the sources show; VulDB lists no countermeasure. Tenda's own page was not found. Until then: disable remote/WAN admin, set a strong admin password, and consider replacing the device.

## Timeline

- 2026-11-14T15:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129258
- 2026-11-14T15:32:31+00:00 analyst https://vuldb.com/vuln/437295 — Only VulDB (CNA) source found; no Tenda advisory or fix. VulDB: PoC public on GitHub, exploitation requires authentication (CVSS PR:H). Not exploited per sources. Nothing verified since no vendor page.

## Documents

- [describes] VulDB VDB-437295: Tenda AC18 /cgi-bin/upgrade upgradeFile data authenticity https://vuldb.com/vuln/437295

## From the sources

A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_