CVE-2026-82695CWE-287CWE-306

CVE-2026-82695

Critical · published August 31, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.01407 · 72.4th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-08-31T17:18Z
References (6)
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md · [email protected]https://vuldb.com/cve/CVE-2026-82695 · [email protected]https://vuldb.com/submit/894242 · [email protected]https://vuldb.com/vuln/397183 · [email protected]https://vuldb.com/vuln/397183/cti · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 1%
    epss
  • 31 AUG 12:45Z
    Tenda AC18 Telnet telnet missing authentication
    cvelistv5