A vulnerability was determined in Tenda A18 15

CVE-2026-2876 is a stack-based buffer overflow in parse_macfilter_rule behind the /goform/setBlackRule handler on Tenda A18 firmware 15.13.07.13. The bug is triggered by an oversized deviceList parameter and the published CVSS vector marks it as PR:L, so this is not an unauthenticated internet spray-and-pray bug; the attacker needs access to the device's management plane and some level of valid session or credentials first.

The vendor's 8.8/HIGH score is fair in a lab because memory corruption on a network device can mean full device compromise. In real enterprise environments, though, this is a downgrade to MEDIUM because the attack chain is cramped: it targets a discontinued consumer Wi‑Fi extender, requires authenticated access, typically lives on a local management interface, has no KEV listing, and carries a very low EPSS.

Why this verdict

• Down from 8.8 because PR:L means this is not pre-auth internet RCE; the attacker already needs credentials or an authenticated session.
• Down again because attacker position is usually internal/LAN-side; Tenda A18 management is typically local, which implies either prior foothold or insider reachability.
• Down again because exposure population is small and odd for enterprises; this is a discontinued consumer Wi‑Fi extender, not a broadly deployed enterprise control plane.
• Down again because the affected set appears narrow; public records point to the exact build 15.13.07.13, not a sweeping multi-year affected range.
• No upward pressure from threat intel; there is public proof material, but no KEV entry, no verified active exploitation, and EPSS is very low.

Why not higher?

If this were unauthenticated and commonly exposed on the WAN, the score would jump fast because a memory corruption bug on a network appliance can be takeover-grade. But stacking the real-world friction points together — local management reachability, required auth, narrow versioning, low deployment prevalence, and no exploitation evidence — keeps it out of HIGH.

Why not lower?

This is still a remotely reachable memory corruption flaw in network-device firmware, not a cosmetic info leak. Once an attacker has management access, the impact on that device can be serious, and public exploit material means defenders should not dismiss it as purely theoretical.

1. Isolate management access — Put A18 management behind a dedicated admin VLAN or management ACLs so only approved jump hosts can reach it. For a MEDIUM verdict there is no noisgate mitigation SLA, so do this in the normal network-hardening cycle while keeping the asset inside the 365-day remediation window.
2. Kill shadow IT extenders — Sweep for consumer repeaters and remove or formally onboard them, because the biggest risk amplifier here is unmanaged local admin exposure. With no mitigation SLA for MEDIUM, prioritize this through regular asset governance and complete replacement or remediation within 365 days.
3. Rotate device credentials — Reset any reused or weak admin passwords and ensure the credentials differ from Wi‑Fi passphrases or shared helpdesk passwords. This directly attacks the PR:L prerequisite and should be folded into standard credential hygiene before the 365-day remediation deadline.
4. Block user VLANs from admin endpoints — Prevent routine workstation segments from reaching 192.168.0.254, re.tenda.cn, or equivalent device-admin addresses. That turns a credentialed bug into a much harder two-hop operation and is an effective compensating control while you work the 365-day remediation plan.
5. Prefer replacement over indefinite exception — Because the vendor site marks A18 as retired and no clear fixed version was located, treat any surviving A18s as lifecycle debt. For MEDIUM, there is no mitigation SLA — document, constrain, and replace inside the 365-day remediation window.

Run this on an auditor workstation or management jump box, not on the repeater itself. Invoke it as python3 check_tenda_a18_cve_2026_2876.py --model A18 --firmware 15.13.07.13 if you already know inventory data, or try python3 check_tenda_a18_cve_2026_2876.py --url http://192.168.0.254/ for a best-effort unauthenticated check; no elevated privileges are required.

#!/usr/bin/env python3
# check_tenda_a18_cve_2026_2876.py
# Non-destructive checker for CVE-2026-2876
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / insufficient evidence

import argparse
import re
import sys
from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

VULN_MODEL = 'A18'
VULN_FW = '15.13.07.13'
TIMEOUT = 5


def verdict(msg, code):
    print(msg)
    sys.exit(code)


def normalize_model(model):
    return model.strip().upper() if model else None


def normalize_fw(fw):
    return fw.strip() if fw else None


def check_inventory(model, firmware):
    model = normalize_model(model)
    firmware = normalize_fw(firmware)

    if model != VULN_MODEL:
        verdict(f'PATCHED: model {model} is not {VULN_MODEL}', 0)

    if firmware == VULN_FW:
        verdict(f'VULNERABLE: {VULN_MODEL} firmware {VULN_FW} matches CVE-2026-2876 affected version', 1)

    if firmware:
        verdict(f'PATCHED: {VULN_MODEL} firmware {firmware} does not match affected version {VULN_FW}', 0)

    verdict('UNKNOWN: model supplied but firmware version missing', 2)


def fetch_url(url):
    req = Request(url, headers={'User-Agent': 'noisgate-cve-check/1.0'})
    with urlopen(req, timeout=TIMEOUT) as resp:
        content_type = resp.headers.get('Content-Type', '')
        body = resp.read(65536).decode('utf-8', errors='ignore')
        return content_type, body


def extract_version(text):
    patterns = [
        r'15\.13\.07\.13',
        r'firmware[^\n\r:]{0,30}(\d+\.\d+\.\d+\.\d+)',
        r'version[^\n\r:]{0,30}(\d+\.\d+\.\d+\.\d+)',
        r'v?(\d+\.\d+\.\d+\.\d+)'
    ]
    for pat in patterns:
        m = re.search(pat, text, flags=re.IGNORECASE)
        if m:
            if m.group(0) == VULN_FW:
                return VULN_FW
            if m.lastindex:
                return m.group(1)
            return m.group(0)
    return None


def check_url(url):
    try:
        _, body = fetch_url(url)
    except HTTPError as e:
        verdict(f'UNKNOWN: HTTP error while fetching {url}: {e.code}', 2)
    except URLError as e:
        verdict(f'UNKNOWN: connection error while fetching {url}: {e.reason}', 2)
    except Exception as e:
        verdict(f'UNKNOWN: unexpected error while fetching {url}: {e}', 2)

    body_upper = body.upper()
    if 'TENDA' not in body_upper and 'A18' not in body_upper and 'RE.TENDA.CN' not in body_upper:
        verdict('UNKNOWN: target did not clearly identify as a Tenda A18 management page', 2)

    version = extract_version(body)
    if version == VULN_FW:
        verdict(f'VULNERABLE: discovered firmware version {VULN_FW} on apparent Tenda A18 page', 1)
    elif version:
        verdict(f'PATCHED: apparent Tenda A18 page exposes firmware version {version}, not affected version {VULN_FW}', 0)
    else:
        verdict('UNKNOWN: page looks like Tenda admin UI, but firmware version was not exposed unauthenticated', 2)


def main():
    parser = argparse.ArgumentParser(description='Check Tenda A18 exposure to CVE-2026-2876')
    parser.add_argument('--model', help='Device model from inventory, e.g. A18')
    parser.add_argument('--firmware', help='Firmware version from inventory, e.g. 15.13.07.13')
    parser.add_argument('--url', help='Base URL of suspected device, e.g. http://192.168.0.254/')
    args = parser.parse_args()

    if args.model:
        check_inventory(args.model, args.firmware)

    if args.url:
        check_url(args.url)

    verdict('UNKNOWN: provide either --model/--firmware or --url', 2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-2876
2. GitHub issue with public disclosure / proof material
3. Tenda A18 search/product page showing retired status
4. Tenda A18 manual download page
5. Tenda A18 user manual mirror with login address details
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview