CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Description
CVE-2018-14558 is a critical-severity command injection vulnerability affecting multiple Tenda router models, including the AC7, AC9, and AC10. The formsetUsbUnload function in the router firmware executes a dosystemCmd function with untrusted input from the goform/setUsbUnload request, allowing remote attackers to execute arbitrary OS commands without authentication. This command injection vulnerability affects Tenda AC7 firmware through V15.03.06.44_CN, AC9 firmware through V15.03.05.19(6318)_CN, and AC10 firmware through V15.03.06.23_CN. CISA has added CVE-2018-14558 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 77.3% (99.0th percentile) indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tenda | ac7 firmware | <= 15.03.06.44_cn |
| tenda | ac9 firmware | <= 15.03.05.19\(6318\)_cn |
| tenda | ac10 firmware | <= 15.03.06.23_cn |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-01/Tenda.md(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14558(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
OS Command Injection occurs when software constructs all or part of an OS command using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2018-14558, the Tenda router firmware’s formsetUsbUnload function passes user-supplied data from the goform/setUsbUnload endpoint directly to the dosystemCmd function, enabling attackers to inject arbitrary operating system commands through crafted POST requests.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2018-14558 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating an extremely severe threat across all three impact dimensions. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction. Confidentiality (High): Attackers executing arbitrary OS commands gain unrestricted access to all data stored on the router, including wireless credentials, connected device information, and network configuration details. Integrity (High): Command execution allows modification of firmware, routing tables, DNS settings, and firewall rules, enabling persistent backdoors or man-in-the-middle attacks. Availability (High): Attackers can shut down services, brick the device, or use it as a launching point for denial-of-service attacks against other network resources. With an EPSS score of 77.3% (99.0th percentile), exploitation is highly likely, and the broad range of affected Tenda models increases the attack surface considerably.
Exploit Maturity
CVE-2018-14558 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 77.3% (99.0th percentile) indicates a very high probability of exploitation activity. While the primary exploit reference link is reported as broken, the vulnerability’s simplicity (direct command injection via a POST parameter) and its presence in widely deployed consumer routers make it a prime target for IoT botnets and automated scanning campaigns. Federal agencies were required to remediate by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply firmware updates immediately as required by CISA KEV: Apply updates per vendor instructions. Update affected Tenda devices (AC7, AC9, AC10) to the latest firmware versions that address the command injection in the goform/setUsbUnload endpoint.
- Disable WAN-side management: Ensure the router’s web management interface and the goform/setUsbUnload endpoint are not accessible from the internet. Configure the device to only allow management access from the local network.
- Deploy network segmentation: Isolate affected Tenda routers in a dedicated network segment with strict access control lists (ACLs) to contain potential compromise and prevent lateral movement.
- Monitor for indicators of compromise: Review network traffic logs for unusual activity originating from the router, including unexpected DNS queries, connections to known botnet command-and-control servers, or abnormal traffic volumes.
- Plan device replacement: Given the multiple Tenda models affected and the vendor’s history with similar vulnerabilities (see also CVE-2020-10987), evaluate replacing these devices with enterprise-grade routers that have documented security update commitments and proper input validation practices.
Technical Details
CVE-2018-14558 is an OS command injection vulnerability affecting the goform/setUsbUnload endpoint across multiple Tenda router models: AC7 (firmware through V15.03.06.44_CN), AC9 (firmware through V15.03.05.19(6318)_CN), and AC10 (firmware through V15.03.06.23_CN). The root cause lies in the formsetUsbUnload function, which takes user-supplied input from the POST request and passes it directly to the dosystemCmd function without any sanitization, filtering, or escaping of shell metacharacters. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, has low complexity, and requires no privileges or user interaction. An attacker can craft a malicious POST request to goform/setUsbUnload containing shell commands embedded in the request parameters, which are then executed directly by the operating system with the privileges of the web server process, typically running as root on these embedded Linux devices.
Frequently Asked Questions
Is CVE-2018-14558 being actively exploited?
Yes. CVE-2018-14558 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 77.3% (99.0th percentile) indicates a very high likelihood of exploitation, and the straightforward nature of the command injection makes it easily weaponizable.
What products are affected by CVE-2018-14558?
CVE-2018-14558 affects three Tenda router models: AC7 (firmware through V15.03.06.44_CN), AC9 (firmware through V15.03.05.19(6318)_CN), and AC10 (firmware through V15.03.06.23_CN). All three models share the vulnerable goform/setUsbUnload endpoint.
How do I fix CVE-2018-14558?
Apply the latest firmware updates from Tenda for the affected AC7, AC9, and AC10 models. If no patches are available, disable remote management access, restrict the web interface to the local network only, and consider replacing the devices with routers that receive regular security updates.
How severe is CVE-2018-14558?
CVE-2018-14558 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity classification. The vulnerability enables unauthenticated remote OS command execution across multiple router models, posing an immediate risk to any network using these Tenda devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.