CVE-2026-82695

critical · 9.3

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

9.3

CVSS

1.4%

EPSS (exploit prob.)

72nd

EPSS percentile

2026-08-31

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-287CWE-306

References

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md
https://vuldb.com/cve/CVE-2026-82695
https://vuldb.com/submit/894242
https://vuldb.com/vuln/397183
https://vuldb.com/vuln/397183/cti
https://www.tenda.com.cn/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-82695