Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Tenda Router Allows Remote Code Execution
CVE-2026-2930
Summary
A bug in the Tenda A18 router's web interface can be exploited by an attacker to run malicious code on the device. This can happen if a hacker sends a specially crafted request to the router. Update the router's software to fix the issue and protect your network.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| tenda | a18_firmware | 15.13.07.13 | – |
Original title
A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of...
Original description
A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of the argument boundary leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
nvd CVSS2.0
6.5
nvd CVSS3.1
8.8
nvd CVSS4.0
5.3
Vulnerability type
CWE-119
Buffer Overflow
CWE-121
Stack-based Buffer Overflow
- https://github.com/master-abc/cve/issues/40 Issue Tracking
- https://vuldb.com/?ctiid.347277 Permissions Required VDB Entry
- https://vuldb.com/?id.347277 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.755227 Third Party Advisory VDB Entry
- https://www.tenda.com.cn/ Product
Published: 22 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026