Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-04-27 | 1 | Disclosure1 |
| 2026-04-28 | 2 | Disclosure2 |
03:00:00 UTC: CVE-2026-31255 lands in NVD. Critical. Tenda AC18 firmware. Remote code execution. No patch.
Post summary
The tweet reports that CVE-2026-31255, a critical remote code execution flaw in Tenda AC18 firmware, has just been added to the NVD, and notes that no patch is currently available.
CVE-2026-31255 Command Injection in Tenda AC18 V15.03.05.05_multi SetSambaCfg Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31255
Post summary
The text announces CVE‑2026‑31255 as a command injection flaw in Tenda AC18’s SetSambaCfg interface, providing the CVE ID and affected product but offering no PoC, exploitation status, patch information, or false positive claim.
CVE-2026-31255 A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling … https://www.cve.org/CVERecord?id=CVE-2026-31255
Post summary
A command injection vulnerability is reported in Tenda AC18 firmware (V15.03.05.05_multi) with details on the affected interface, but no PoC, exploit, active attacks, or patch information is provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tenda | ac18 | - | - | - |
| OS | tenda | ac18_firmware | 15.03.05.05 | - | - |