CVE-2026-82695

Executive Summary

CVE-2026-82695 is a critical, unauthenticated, remotely exploitable authentication bypass vulnerability in the Tenda AC18 wireless router (firmware version 15.03.05.19). The flaw resides in the Telnet Handler component, specifically within the /goform/telnet file, where manipulation of an unknown function results in a complete failure to enforce authentication. With a CVSS base score of 10.0, this vulnerability allows any remote, unauthenticated attacker to gain full control of the device—achieving complete compromise of confidentiality, integrity, and availability. Given that the exploit has been publicly released and no patch exists, all Tenda AC18 devices running the specified firmware version should be considered at immediate and severe risk.

The attack surface is the router's web-based management interface, which exposes the vulnerable telnet form handler over the network. Successful exploitation grants the attacker a Telnet session to the device's underlying operating system, typically with root privileges, enabling total device takeover. The impact is compounded by the fact that the CVSS vector indicates a scope change (S:C), meaning the compromise can have effects beyond the router itself, potentially pivoting into the broader network. As of this report, there is no vendor patch, no workaround provided, and the device is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, though the public availability of the exploit suggests imminent in-the-wild exploitation.

Technical Analysis

Vulnerability Mechanism: The vulnerability is classified as CWE-287 (Improper Authentication). The NVD description indicates that the flaw exists in the Telnet Handler component of the Tenda AC18 firmware, triggered by manipulation of an unknown function within the /goform/telnet file. The specific technical detail is sparse; however, based on the vulnerability class and the target file path, the following mechanism is inferred: the firmware's web management interface processes HTTP requests destined for the /goform/telnet endpoint without performing adequate verification of the caller's identity or session state.

The "missing authentication" condition arises because the handler for this endpoint fails to invoke an authentication check before executing the requested action. In router firmware, goform endpoints (Common Gateway Interface for Tenda's proprietary forms) typically map to backend functions that control hardware and service states. The telnet endpoint is expected to enable or disable the Telnet service. In a properly secured implementation, this action would require an authenticated session token (often a Cookie: bLanguage= session cookie or a goformId parameter). The vulnerable implementation appears to accept these requests without such validation.

Attack Surface: The management interface is, by default, exposed on TCP/80 (HTTP) or TCP/443 (HTTPS). In many router deployments, this interface is accessible from the WAN side due to misconfiguration or user-enablement of remote management. Even if the interface is LAN-only, a compromised client device on the network can serve as the launch point for the attack.

Code-Level Explanation: While the NVD description does not provide specific function names within the firmware binary, the vulnerability pattern is consistent with a classic "direct request" authentication bypass. The logic flaw is likely in a conditional check such as if (is_authenticated()) { enable_telnet(); } where the conditional is either missing, incorrectly scoped, or fails open. The manipulation "of an unknown function" suggests that the attacker can alter the function's behavior—possibly by parameter tampering—to force it to bypass the check. For instance, modifying the request method (GET vs POST), or injecting unexpected parameters such as submit-url or list values, may confuse the state machine into treating the request as already authenticated.

Exploit Publication: The NVD metadata states "The exploit has been released to the public and may be used for attacks." This indicates that a proof-of-concept or exploit script has been published on public repositories, forums, or paste sites. Although the "PoC/Exploit" field in the intelligence feed shows "None," this likely refers to an absence of a vetted, weaponized exploit module in tracked frameworks (e.g., Metasploit), not the absence of public exploit code. The release of even a rudimentary PoC drastically lowers the barrier to exploitation, as script-kiddie tools can automate the compromise of internet-exposed devices.

Exploitation Scenarios

No public PoC is available in the intelligence feed; the attack chain below is inferred from the vulnerability class (CWE-287) and the confirmed remote exploitability.

Step 1: Reconnaissance / Target Identification The attacker scans for Tenda AC18 devices exposed to the internet. Using Shodan-style queries (e.g., http.title:"Tenda" "AC18" or product:"Tenda AC18"), the attacker identifies IP addresses serving the management interface. Alternatively, mass-scanning tools like masscan can be used to identify devices with open TCP/80 or TCP/8080 ports that respond with Tenda-specific HTTP headers or the AC18 product name. The attacker may also use banner grabbing (nc -v victim 80) to retrieve the Server: Tenda header and confirm the model and firmware version (15.03.05.19).

Step 2: Triggering the Authentication Bypass The attacker constructs an HTTP request to the vulnerable endpoint. The exact payload is unknown due to sparse documentation, but the attack class dictates the approach: the attacker sends a request to /goform/telnet without a valid session token, and manipulates the request parameters to force the handler to process the action. The "manipulation" may involve crafting a POST request with specific form data fields, or a simple GET request that triggers a side-effect. For example, the attacker might send: GET /goform/telnet?cmd=1 HTTP/1.1 or POST /goform/telnet HTTP/1.1 with body cmb_telnet=1. Because authentication is missing, the router processes the request and enables the Telnet service (typically on TCP/23).

Step 3: Payload / Execution Method Once the Telnet service is enabled, the attacker establishes a Telnet session to the router's IP address on port 23. The firmware's Telnet daemon normally requires credentials (root/root or admin/password defaults), but given the severity (CVSS 10.0), the attacker likely obtains a root shell without credentials, or the authentication bypass extends to the Telnet login itself. The attacker then has a valid command shell on the device, able to execute arbitrary shell commands (e.g., cat /etc/passwd, iptables -F, or install persistent backdoors).

Step 4: Post-Exploitation Impact With a root shell on the router, the attacker achieves:

• Full confidentiality breach: Read all traffic passing through the router (via tcpdump), steal credentials, and exfiltrate sensitive data.
• Integrity compromise: Modify firewall rules, DNS settings (to redirect traffic to malicious servers), or alter firmware to persist.
• Availability destruction: Deploy denial-of-service, disable the device remotely, or use the router as a botnet node for DDoS campaigns.
• Pivot point: The CVSS scope change (S:C) indicates the compromise can affect resources beyond the router—the attacker can ARP-spoof the LAN, perform man-in-the-middle attacks, or use the router's network access to traverse into other internal hosts.

Impact Assessment

Business Impact: Tenda AC18 is a consumer-grade dual-band gigabit router. While individual home users are the primary victims, the vulnerability poses a significant threat to small and medium businesses (SMBs) that use this device for branch offices or retail environments, as well as to ISPs that provide the device to subscribers. A compromise of the router can expose all unencrypted LAN traffic, enabling credential theft, financial fraud, and data exfiltration. The device can also be leveraged as a staging point for attacks against the cloud-based management systems used by ISPs.

Affected Systems: Only the Tenda AC18 with firmware version 15.03.05.19 is confirmed vulnerable. However, given the lack of vendor engagement and the "Unknown" product status in the CNA data, adjacent firmware versions (e.g., 15.03.05.18 or 15.03.05.20) may share the same vulnerable code; this has not been verified. All deployments that expose the web management interface to untrusted networks (e.g., internet-facing administrative ports) are immediately at risk. Even LAN-only deployments are at risk if any client device is compromised or if a malicious insider exists.

Blast Radius & CVSS Reference: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H breaks down as:

• Attack Vector (AV:N): The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions or race conditions are required for exploitation.
• Privileges Required (PR:N): No authentication is needed.
• User Interaction (UI:N): No user action is required for exploitation.
• Scope (S:C): The compromise extends beyond the router, affecting the connected network.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): Total loss of all three security properties.

This is a "perfect storm" vulnerability: trivially exploitable, remotely accessible, and leading to total device compromise with network-wide consequences. The public exploit release elevates the risk from theoretical to near-certain active exploitation within a short timeframe. The lack of a CISA KEV listing is likely a temporary state tied to the CVE's recent publication; enterprises should monitor CISA KEV updates closely.

Detection Guidance

▲ Note: Because no specific exploit payload is publicly documented in the intelligence feed, the detection rules below target the behavioral signature of the vulnerability—suspicious access to the /goform/telnet endpoint and subsequent Telnet connection attempts. These rules are designed to detect the attack chain regardless of the exact request body.

Sigma Rule

title: Tenda AC18 Telnet Authentication Bypass Attempt
id: 9f7c3b2e-5a8d-4e6b-9c1f-2d4e8a5b6c7d
status: experimental
description: Detects HTTP requests to the /goform/telnet endpoint on Tenda AC18 devices, which indicates an attempt to trigger CVE-2026-82695.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82695
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-path:
            - '/goform/telnet'
    condition: selection
level: critical
falsepositives:
    - Legitimate configuration changes by an administrator (rare; should be out-of-band)
    - Normalized log format variations
fields:
    - src_ip
    - dest_ip
    - cs-uri-query

YARA Rule

rule Tenda_AC18_Telnet_Bypass_CVE_2026_82695
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        description = "Detects exploit payloads or malformed requests targeting /goform/telnet in Tenda AC18"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82695"
        severity = "Critical"
    strings:
        $s1 = "/goform/telnet"
        $s2 = "cmd=telnet"
        $s3 = "telnet_enable"
        $s4 = "goformId"
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"Tenda AC18 Telnet Authentication Bypass (CVE-2026-82695)"; flow:established,to_server; content:"/goform/telnet"; http_uri; nocase; classtype:attempted-admin; sid:2026082695; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where dns.question.name : "*tenda*" or http.request.uri : "/goform/telnet" ]
  [ process where event.action == "exec" and process.executable : "*telnet*" ]

Splunk SPL Query

index=weblog sourcetype=access_combined
| where uri_path="/goform/telnet"
| eval message="Potential CVE-2026-82695 exploitation attempt against Tenda AC18"
| table _time, src_ip, dest_ip, uri, method, status
| sort -_time

Wazuh OSSEC Rule

<group name="tenda,cve-2026-82695,">
  <rule id="507126" level="14">
    <decoded_as>web-access-log</decoded_as>
    <regex>\/goform\/telnet</regex>
    <description>Tenda AC18 - /goform/telnet accessed - possible CVE-2026-82695 authentication bypass attempt</description>
    <group>tenda,cve-2026-82695,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no fixed firmware version, and no workaround have been identified from any tracked source. The vendor (Tenda) has not publicly acknowledged the vulnerability or released a patched firmware. Do not wait for a patch; assume all affected devices are compromised or will be compromised imminently.

1. Immediate Mitigations (Defense in Depth):

• Disable remote management: If the web management interface is exposed to the WAN/internet, disable it immediately via the device's local console (if possible) or by performing a factory reset and reconfiguring without enabling remote access. This is the single most effective immediate action.
• Block inbound access: Implement firewall rules at the perimeter to block inbound connections to the router's management ports (typically TCP/80, 443, 23) from untrusted IP addresses. Restrict access to trusted management IPs only.
• Decommission vulnerable devices: The safest mitigation is to power down and remove Tenda AC18 devices running firmware 15.03.05.19 from the network until a patch is available. If the device is critical to operations, segregate it into a restricted VLAN with no access to sensitive network segments.
• Monitor logs: Deploy the detection rules above to monitor for any attempted exploitation. Assume a breach has occurred if any suspicious traffic is observed.

2. Patch/Upgrade Steps:

• Check for firmware updates: Regularly visit Tenda's official support website (tendacn.com or regional equivalents) to check for a patched firmware release. As of this report, none exists.
• Subscribe to vendor advisories: Sign up for Tenda's security mailing list or RSS feed to be notified of any future patches.
• Apply the patch when available: Once a patched firmware is released (e.g., version 15.03.05.20+), apply it via the router's web interface (System → Firmware Upgrade) or via TFTP upload. Verify the firmware checksum before applying.

3. Long-Term Hardening:

• Replace the device: Given the lack of vendor responsiveness and the criticality of the flaw, strongly consider replacing all Tenda AC18 units with enterprise-grade routers from vendors with a proven security track record (e.g., Cisco, Fortinet, Ubiquiti with security focus).
• Configuration baseline: For any router deployed, enforce a baseline configuration: change default credentials, disable Telnet entirely (use SSH only), disable UPnP and remote management, and restrict management interfaces to dedicated VLANs.
• Network segmentation: Place all network infrastructure devices (routers, switches, APs) in a dedicated management VLAN with strict ACLs preventing access from general user segments.
• Continuous monitoring: Deploy the detection rules provided above across your SIEM/IDS infrastructure to detect both this vulnerability and similar authentication bypass attempts against other embedded devices.

References

1. NVD Entry — National Vulnerability Database record for CVE-2026-82695: https://nvd.nist.gov/vuln/detail/CVE-2026-82695
2. Tenda Official Website — Vendor resource for AC18 firmware downloads (note: no patch available as of writing): https://www.tenda.com.cn/product/AC18.html
3. CISA Known Exploited Vulnerabilities Catalog — The CVE is currently NOT listed on KEV; monitor for updates: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. FIRST.org EPSS — EPSS score not yet published for this CVE; check for future scoring: https://www.first.org/epss/
5. MITRE ATT&CK — Technique T1190 (Exploit Public-Facing Application) for kill-chain mapping: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: The NVD description confirms "The exploit has been released to the public." While no specific threat actor group has been attributed to this vulnerability yet, the public availability of a PoC, combined with the CVSS 10.0 rating and the prevalence of Tenda devices, makes this a prime candidate for inclusion in Mirai-style IoT botnets and initial access brokers' toolkits. Security teams should expect scanning and exploitation attempts within days of this report's publication. The CISA KEV listing absence is temporary; assume active exploitation is imminent or ongoing.