CVE-2026-129258 is a critical flaw (CVSS 3.1: 9.1) in the firmware upgrade handler of the Tenda AC18 router: the router does not properly check that firmware is authentic, and a public exploit is available.
What Is It
The flaw is in the /cgi-bin/upgrade endpoint of the AC18's Firmware Upgrade Handler. By manipulating the upgradeFile argument, an attacker can get past the router's check that firmware is authentic (CWE-345: Insufficient Verification of Data Authenticity). The attack works remotely over the network. The researcher advisory linked in the NVD references is titled as an "unsigned firmware update advisory."
VulDB, the CVE Numbering Authority (CNA) that issued this CVE, scores it:
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.5 HIGH, with exploit maturity marked as Proof-of-Concept
- CVSS 2.0: 8.3 HIGH
NVD published the record on 2026-11-14. Its status is currently "Deferred."
Why It Matters
A firmware upgrade path that doesn't verify authenticity gives an attacker a direct way to replace what the device runs. The CVSS 3.1 vector reflects that: high impact to confidentiality, integrity and availability, with a changed scope, meaning the damage can reach beyond the vulnerable component.
The main limit is that high privileges are required, so an attacker needs administrative access to the upgrade function. Attack complexity is low and no user interaction is needed.
According to the CNA, the exploit is public and "might be used." CISA has not listed this CVE in its Known Exploited Vulnerabilities (KEV) catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: Tenda
- Product: AC18
- Component: Firmware Upgrade Handler (
/cgi-bin/upgrade) - Affected versions:
- 15.03.05.05_multi
- 15.03.05.19 Build 6318
- CPE:
cpe:2.3:o:tenda:ac18_firmware:*:*:*:*:*:*:*:*
Patch Status
The supplied records list no fixed version, vendor advisory or patch. The only vendor reference is Tenda's main website. Because there is no KEV entry, there is also no CISA required action or remediation deadline.
AC18 owners running the affected versions should watch Tenda for a firmware update and review the researcher advisory and VulDB entries below for any changes.