CVE-2026-38142 describes a command injection vulnerability in the Tenda AC18 router firmware version 15.03.05.05. The vulnerability is located in the /goform/fast_setting_internet_set endpoint, where the mac parameter is not properly sanitized, allowing unauthenticated attackers to inject and execute arbitrary commands on the device. No CVSS score or detailed vendor advisory is available, and no patch or remediation information has been provided.

Successful exploitation allows unauthenticated attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the router, disruption of network services, or further attacks on connected systems. The lack of authentication increases the risk as no credentials are required to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint by network segmentation or firewall rules to prevent unauthenticated access. Monitor for unusual activity related to this endpoint and consider disabling remote management features if enabled.