July 2026 CVE Landscape
60
CVE-2018-14558
Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers
CISA: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 9%p95
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2018-14558 is an unauthenticated OS command injection flaw (CWE-78) in the web interface of Tenda AC7, AC9, and AC10 routers, where the formsetUsbUnload handler passes untrusted input to the dosystemCmd function. An attacker triggers it by sending a crafted HTTP request to the goform/setUsbUnload endpoint, requiring no authentication or user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary command execution on the router, enabling full device takeover for traffic interception, botnet enrollment, or pivoting into the local network. Anyone running AC7 firmware through V15.03.06.44_CN(AC7), AC9 firmware through V15.03.05.19(6318)_CN(AC9), or AC10 firmware through V15.03.06.23_CN(AC10) is affected. The flaw has a public proof of concept, an 8.7% EPSS (95th percentile), and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.
What to do: Apply updated firmware from Tenda per vendor/CISA instructions, upgrading AC7 beyond V15.03.06.44_CN, AC9 beyond V15.03.05.19(6318)_CN, and AC10 beyond V15.03.06.23_CN. Until patched, avoid exposing the router's web management interface to the internet (disable remote/WAN management) and restrict admin access to trusted clients. Check device logs for unsolicited requests to goform/setUsbUnload as an indicator of exploitation.
| Product | Affected |
|---|---|
| Tenda AC7 router firmware | through V15.03.06.44_CN(AC7) |
| Tenda AC9 router firmware | through V15.03.05.19(6318)_CN(AC9) |
| Tenda AC10 router firmware | through V15.03.06.23_CN(AC10) |
Estimated exposure
massplausibly 1M+ affected devices (estimate; hundreds of thousands of Tenda web interfaces appear internet-exposed in public scans) — Tenda is a top-selling budget consumer router brand and the AC7/AC9/AC10 line was widely sold in Asia and emerging markets, so the cumulative installed base plausibly exceeds one million units, with public internet scans routinely…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.
KEVCISA Known Exploited Vulnerability
- Affected
- Tenda AC7, AC9, and AC10 Routers
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- tenda
- Products
- ac7 firmware, ac9 firmware, ac10 firmware
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
4 stories60
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
45