LiveActive security incident?Get immediate response
CVE Record

CVE-2026-82695: Tenda AC18 Telnet telnet missing authentication

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remotely reachable attacker may access a critical Telnet-related function on a Tenda AC18 without authentication. For devices running firmware 15.03.05.19, this could compromise the router and connected operations. The reported CVSS 4.0 score is 10.0.

Executive priority

Treat confirmed affected devices as an immediate remediation priority, especially when remotely accessible. Reduce exposure now while obtaining authoritative vendor guidance. Public exploit availability and complete confidentiality, integrity, and availability impacts justify urgent ownership and tracking.

Technical view

CVE-2026-82695 affects the Telnet Handler at /goform/telnet in Tenda AC18 firmware 15.03.05.19. The handler reportedly lacks required authentication and is remotely reachable without privileges or user interaction. The supplied record maps the weakness to CWE-287 and CWE-306.

Likely exposure

Confirmed scope is limited to Tenda AC18 firmware 15.03.05.19. Risk is greatest where the affected management handler is reachable from untrusted networks. The bundle does not establish whether other firmware versions or Tenda products are affected.

Exploitation context

Public exploit information is available, increasing practical risk. The supplied CVSS vector marks exploit maturity as proof-of-concept. However, this CVE is not listed as KEV in the bundle, and no cited evidence confirms active exploitation.

Researcher notes

The bundle supports missing authentication, remote reachability, public exploit disclosure, and a CVSS 4.0 score of 10.0. It does not name a patched version, vendor workaround, observed attack campaign, or affected versions beyond 15.03.05.19. Validation should remain non-invasive on production equipment.

Mitigation direction

  • Identify Tenda AC18 devices and verify their installed firmware versions.
  • Block untrusted access to router management services and the affected Telnet handler.
  • Restrict device administration to trusted management networks.
  • Check Tenda guidance for a fixed firmware version or vendor-approved mitigation.
  • Prioritize replacement if no supported remediation is available.

Validation and detection

  • Inventory network assets for Tenda AC18 hardware.
  • Confirm whether firmware version 15.03.05.19 is installed.
  • Review firewall and management settings for exposure to untrusted networks.
  • Search relevant logs for unexpected requests to /goform/telnet.
  • Verify any remediation against current Tenda guidance.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-287: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-306: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-82695 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDB
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.96VulDB
10CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.96VulDB
10CVSS 2.0CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR1010VulDB

Vulnerability scoring details

Base CVSS 4.0 score

10Critical
CVSS 4.0 vector shape for CVE-2026-82695Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineVulDB

    VulDB entry last update

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TendaAC1815.03.05.19Listed
Weakness

CWE details

CWE-287CWE-306

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-287 · source CWE mapping

Improper Authentication

Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-306 · source CWE mapping

Missing Authentication for Critical Function

Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs