Critical severity · published Aug 31, 2026
CVE-2026-82695
Tenda AC18 Telnet telnet missing authentication
10.0
CVSS
1.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC18 · Tenda
15.03.05.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82695
github.com
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md
vuldb.com
https://vuldb.com/cve/CVE-2026-82695
vuldb.com
https://vuldb.com/submit/894242
vuldb.com
https://vuldb.com/vuln/397183
vuldb.com
https://vuldb.com/vuln/397183/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from AC18
9.8
CVE-2026-31255
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi
9.8
CVE-2025-5606
A vulnerability was found in Tenda AC18 15.03.05.05
9.8
CVE-2024-57583
Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function
9.8
CVE-2024-57582
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function
9.8
CVE-2024-57581
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function