Critical Authentication Bypass in Tenda AC18 Telnet Handler

CVE-2026-82695 identifies a critical security flaw in Tenda AC18 firmware version 15.03.05.19, residing in the Telnet Handler component. Specifically, the function located at /goform/telnet fails to perform proper authentication, permitting remote, unauthenticated actors to access the device's Telnet interface. This vulnerability is remotely exploitable and has been publicly disclosed with functional exploit code, posing a significant risk of device compromise. As the device provides management services, successful exploitation allows attackers to gain full administrative control over the network gateway, potentially enabling traffic interception, lateral movement, or use of the router as a botnet node. Defenders should assume that adversaries may use this as an initial access vector for further compromise of connected local networks.

Impact

Successful exploitation of this vulnerability results in full administrative access to the Tenda AC18 device. This exposure impacts the confidentiality, integrity, and availability of all traffic routed through the affected device. Public availability of exploit code increases the likelihood of opportunistic scanning and mass-exploitation attempts by automated botnets targeting consumer and small-office network hardware.

Recommendation

1. Immediately restrict access to the Tenda AC18 web management and Telnet interfaces to trusted management subnets only.
2. Monitor firewall logs for unauthorized connection attempts to port 23 (Telnet) on Tenda devices.
3. Search for firmware updates from the vendor; if no patch is available, replace the device or isolate it from public-facing segments.
4. Implement network-level segmentation to prevent the Tenda device from reaching internal critical assets.