60
CVE-2018-14558
KEV PoC massUnauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers
CISA: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
9%p95
Published
()
KEV added
AI analysis
CVE-2018-14558 is an unauthenticated OS command injection flaw (CWE-78) in the web interface of Tenda AC7, AC9, and AC10 routers, where the formsetUsbUnload handler passes untrusted input to the dosystemCmd function. An attacker triggers it by sending a crafted HTTP request to the goform/setUsbUnload endpoint, requiring no authentication or user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary command execution on the router, enabling full device takeover for traffic interception, botnet enrollment, or pivoting into the local network. Anyone running AC7 firmware through V15.03.06.44_CN(AC7), AC9 firmware through V15.03.05.19(6318)_CN(AC9), or AC10 firmware through V15.03.06.23_CN(AC10) is affected. The flaw has a public proof of concept, an 8.7% EPSS (95th percentile), and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.
What to do: Apply updated firmware from Tenda per vendor/CISA instructions, upgrading AC7 beyond V15.03.06.44_CN, AC9 beyond V15.03.05.19(6318)_CN, and AC10 beyond V15.03.06.23_CN. Until patched, avoid exposing the router's web management interface to the internet (disable remote/WAN management) and restrict admin access to trusted clients. Check device logs for unsolicited requests to goform/setUsbUnload as an indicator of exploitation.
Affected
| Tenda AC7 router firmware | through V15.03.06.44_CN(AC7) |
| Tenda AC9 router firmware | through V15.03.05.19(6318)_CN(AC9) |
| Tenda AC10 router firmware | through V15.03.06.23_CN(AC10) |
Estimated exposure
massplausibly 1M+ affected devices (estimate; hundreds of thousands of Tenda web interfaces appear internet-exposed in public scans) — Tenda is a top-selling budget consumer router brand and the AC7/AC9/AC10 line was widely sold in Asia and emerging markets, so the cumulative installed base plausibly exceeds one million units, with public internet scans routinely…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.
CISA Known Exploited Vulnerability
- Affected
- Tenda AC7, AC9, and AC10 Routers
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- tenda
- Products
- ac7 firmware, ac9 firmware, ac10 firmware
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news4 stories
60
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
Fortinet FortiGuard Labs identified Evooo1Bot, a previously undocumented Linux botnet built on the leaked Mirai source code, active in the wild since July 2026 and targeting internet-facing edge devices. It exploits numerous known CVEs in routers and devices from D-Link, Tenda, Telesquare, Zyxel, Hikvision, Atlassian Confluence, WSO2, TP-Link, NETGEAR, and others, delivering a bot binary via a wget.sh loader from 91.92.40.118 that clears bash history. The bot offers encrypted C2 on port 443, SSH brute-force scanning, credential sniffing, DDoS over DNS/TCP/UDP, an HTTP exploit dispatcher, and converts infected hosts into SOCKS5 proxies for anonymizing follow-on operations.
55
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
45