PT-2026-54758 · Undefined · Undefined

Longqx223 · Publicado 2026-07-01 · Atualizado 2026-07-01 · CVE-2026-38142

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

An unauthenticated command injection vulnerability in the /goform/fast setting internet set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-38142

Produtos afetados

Undefined

Referências · 2

• 🔥 https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/blob/main/Tenda%20AC18%20Unauthenticated%20Second-Order%20OS%20Command%20Injection%20in%20goformfast_setting_internet_set.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38142 · Nota de Segurança