Critical severity · published Aug 31, 2026
CVE-2026-82695
Tenda AC18 Telnet telnet missing authentication
10.0
CVSS
1.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC18 · Tenda
15.03.05.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82695
github.com
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md
vuldb.com
https://vuldb.com/cve/CVE-2026-82695
vuldb.com
https://vuldb.com/submit/894242
vuldb.com
https://vuldb.com/vuln/397183
vuldb.com
https://vuldb.com/vuln/397183/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from AC18
9.8
CVE-2026-31255
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi
9.8
CVE-2025-5606
Tenda AC18 SetIPTVCfg formSetIptv command injection
9.8
CVE-2024-57580
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function
9.8
CVE-2024-57575
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function
9.8
CVE-2024-57579
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function