This vulnerability involves a command injection flaw in Tenda AC18 router firmware V15.03.05.05_multi, specifically in the /goform/SetSambaCfg interface. The guestuser parameter is not properly sanitized, enabling attackers with low privileges to execute arbitrary system commands remotely over the network. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact without availability impact. No patch or official remediation level is provided in the available data.

Successful exploitation allows an attacker with low privileges to execute arbitrary system commands on the affected device, potentially leading to limited confidentiality and integrity compromise. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected interface and limit user privileges where possible to reduce exposure.