The Tenda AC18 router is susceptible to a critical unauthenticated remote command execution vulnerability that allows an attacker to enable the Telnet service and gain unauthorized system access.

The vulnerability exists within the /goform/telnet handler of the /bin/httpd component. An unauthenticated attacker can send a direct HTTP request to this endpoint to trigger shell commands that start the Telnet daemon, effectively bypassing all authentication controls.

The exploitation of this vulnerability results in a complete compromise of the router, allowing an attacker to gain full administrative control over the network gateway. Given the CVSS score of 10.0, this flaw poses an extreme risk, as it permits unauthorized remote access, potential data interception, and the ability to use the compromised device as a pivot point for further attacks on the internal network.

Immediate Action: Disconnect the affected Tenda AC18 router from the internet and update the firmware to the latest available version provided by the vendor. If an update is not immediately available, disable all remote management features and restrict access to the web interface to trusted management IP addresses only.

Proactive Monitoring: Review system access logs for any unauthorized HTTP requests directed at the /goform/telnet endpoint. Monitor the device for unexpected Telnet connections or abnormal traffic patterns originating from the router.

Compensating Controls: Implement a Web Application Firewall (WAF) or an edge firewall rule to block all incoming traffic to the /goform/telnet path. Ensure that the device is not exposed to the public internet by placing it behind a more secure enterprise-grade firewall.

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the technical write-up published on GitHub.

The severity of this vulnerability is critical, and the availability of a public proof-of-concept significantly increases the likelihood of opportunistic exploitation. IT administrators should prioritize the remediation of all affected Tenda AC18 devices immediately to prevent unauthorized access and potential network-wide compromise.