ACTIVELY EXPLOITED
CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
| Vendor | Tenda |
|---|---|
| Product | AC7, AC9, and AC10 Routers |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
SOURCES
Other Tenda flaws
- CVE-2021-31755: Tenda AC11 Router Stack Buffer Overflow Vulnerability
- CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.