PT-2026-54758 · Undefined · Undefined

Longqx223 · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-38142

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

An unauthenticated command injection vulnerability in the /goform/fast setting internet set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-38142

Affected Products

Undefined

References · 2

• 🔥 https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/blob/main/Tenda%20AC18%20Unauthenticated%20Second-Order%20OS%20Command%20Injection%20in%20goformfast_setting_internet_set.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38142 · Security Note