CVE-2026-82695: Missing Authentication in Tenda AC18

This vulnerability affects the Tenda AC18 router firmware version 15.03.05.19. A missing authentication mechanism in the Telnet Handler component's /goform/telnet endpoint allows remote attackers to access functionality without credentials. The vulnerability is remotely exploitable and has a critical CVSS 4.0 score of 10. Exploit code has been publicly released. The vendor has not yet provided an official fix or remediation instructions. The vulnerability was published on 2026-08-31.

Successful exploitation grants unauthenticated remote attackers access to a Telnet-related function on the Tenda AC18 router, potentially allowing unauthorized control or configuration changes. Given the critical CVSS score of 10, the impact is severe, likely enabling full compromise of the device or network access through it. No active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling Telnet access on the device if possible or restrict network exposure to trusted sources. Monitor vendor channels for updates and apply patches promptly once available.