A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A critical security vulnerability has been identified in Tenda AC18 firmware version 15.03.05.19. The flaw resides in the /goform/telnet endpoint within the Telnet Handler component. The vulnerability allows attackers to bypass authentication entirely, enabling unauthorized remote access. The attack vector is network-based and requires no authentication or special privileges. A public exploit has already been released, significantly raising the risk of active exploitation. The vulnerability is classified as missing authentication, which is a fundamental security control failure. Affected users should apply patches or mitigations as soon as possible to prevent unauthorized access to their routers.