A vulnerability has been found in Tenda A18 15

CVE-2026-2877 is a stack-based buffer overflow in the Tenda A18 httpd service, specifically the /goform/WifiExtraSet path handling the wpapsk_crypto5g parameter. Public reversing shows the request reaches fromSetWirelessRepeat, then copies attacker-controlled data into a 16-byte stack buffer with strcpy, creating a crash path and possible code-execution path. The affected version reported by NVD/CPE is Tenda A18 firmware 15.13.07.13.

The vendor's HIGH 8.8 score is technically defensible in a lab because memory corruption on a network appliance can be ugly. In enterprise reality, it overstates urgency: the attack is not unauthenticated internet RCE. The product is a consumer Wi-Fi extender, the management flow is normally reached only after connecting to the extender's local Wi-Fi or LAN admin plane, the CVSS vector itself requires low privileges, and the product line appears EOL with no clear fixed V1.0 firmware published.

Why this verdict

• Requires authenticated access: the published repro logs in first and CVSS already says PR:L, which cuts out the huge class of unauthenticated smash-and-grab attacks
• Usually local/adjacent exposure: Tenda's own setup flow assumes the operator is connected to the A18 Wi-Fi/LAN and browses to re.tenda.cn; that implies post-connectivity reach, not broad edge exposure
• Low exploitation pressure: no KEV listing, no public campaign reporting, and low EPSS all push this down from emergency status
• Narrow platform and blast radius: this is one consumer extender model/firmware line, not a ubiquitous enterprise control plane with domain-wide consequences
• EOL amplifies remediation pain, not attacker scale: support weakness makes ownership annoying, but it does not by itself convert a gated local/admin bug into a critical internet event

Why not higher?

Because this is not the classic thing that ruins your weekend at scale: there is no evidence here of unauthenticated public-edge exploitation against a widely exposed enterprise service. The chain depends on prior reachability to a usually local admin plane and low-privilege authentication, which compounds downward pressure on real-world abuse potential.

Why not lower?

It is still memory corruption in network appliance firmware, with public reproduction and plausible code-execution impact. If you actually have these at branches, labs, warehouses, or home-office edge environments, compromise of the device can still enable traffic tampering, persistence on that segment, or service disruption.

1. Inventory every A18 immediately — Find out whether A18 V1.0 / 15.13.07.13 exists anywhere in branch, lab, warehouse, or employee home-office kits. For a MEDIUM verdict there is no mitigation SLA, but you should identify exposure now so the device does not sit invisible until the 365-day remediation window.
2. Block management from untrusted networks — Restrict access to the extender web UI so only a small admin subnet or direct local maintenance path can reach it. Even without a formal mitigation deadline for MEDIUM, this is the fastest way to remove the attacker-position advantage.
3. Set a strong local admin password — This CVE already requires authenticated access, so removing defaults and weak shared passwords meaningfully reduces reachable abuse. Apply wherever the device is still in service; do it during the next local touch if the unit cannot be centrally managed.
4. Retire EOL consumer gear — The A18 line appears EOL and I found no authoritative fixed V1.0 firmware. Treat replacement as the clean remediation path rather than waiting for a patch that may never land; complete within the MEDIUM remediation window.
5. Monitor for admin POST abuse — Alert on unusual POST /login/Auth followed by large POST /goform/WifiExtraSet bodies from non-admin hosts. This helps catch exploit attempts in the handful of places where these appliances are still reachable.

Run this from an auditor workstation on the same local network/Wi-Fi segment as the suspected Tenda A18. Invoke it as bash check_cve_2026_2877.sh http://192.168.0.254 or bash check_cve_2026_2877.sh http://re.tenda.cn admin YourPassword if you want it to attempt authenticated checks; no root is required, but the workstation must be able to reach the device over HTTP.

#!/usr/bin/env bash
# check_cve_2026_2877.sh
# Best-effort verifier for CVE-2026-2877 on Tenda A18.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN, 3=usage/error

set -u

if [[ $# -lt 1 || $# -gt 3 ]]; then
  echo "Usage: $0 <base_url> [username] [password]"
  exit 3
fi

BASE_URL="${1%/}"
USER="${2:-}"
PASS="${3:-}"
TMPDIR="$(mktemp -d)"
COOKIE_JAR="$TMPDIR/cookies.txt"
BODY="$TMPDIR/body.txt"
trap 'rm -rf "$TMPDIR"' EXIT

fetch() {
  local url="$1"
  curl -ksS -L --max-time 8 -c "$COOKIE_JAR" -b "$COOKIE_JAR" "$url" 2>/dev/null || true
}

post_form() {
  local url="$1"
  local data="$2"
  curl -ksS -L --max-time 8 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST -d "$data" "$url" 2>/dev/null || true
}

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

md5hex() {
  local s="$1"
  if have_cmd md5sum; then
    printf "%s" "$s" | md5sum | awk '{print $1}'
  elif have_cmd md5; then
    printf "%s" "$s" | md5 | awk '{print $NF}'
  elif have_cmd openssl; then
    printf "%s" "$s" | openssl md5 | awk '{print $NF}'
  else
    return 1
  fi
}

contains_a18_markers() {
  grep -Eiq '(Tenda|A18|re\.tenda\.cn|Tenda_EXT)' "$BODY"
}

extract_versions() {
  grep -Eo 'V[0-9]{2}\.[0-9]{2}\.[0-9]{2}\.[0-9]{2,3}|15\.13\.07\.13|02\.03\.01\.[0-9]+' "$BODY" | sort -u
}

classify_from_body() {
  if ! contains_a18_markers; then
    return 10
  fi

  local versions
  versions="$(extract_versions || true)"

  if echo "$versions" | grep -qx '15\.13\.07\.13'; then
    echo "VULNERABLE"
    exit 0
  fi

  if grep -Eiq 'A18[[:space:]]*V(2\.0|3\.0|4\.0)|A18 Pro|V02\.03\.' "$BODY"; then
    echo "PATCHED"
    exit 1
  fi

  return 11
}

# 1) Unauthenticated discovery pass
for path in / /index.html /login.html /wizard.html /status.html; do
  fetch "$BASE_URL$path" > "$BODY"
  if [[ -s "$BODY" ]]; then
    classify_from_body || true
  fi
done

# 2) Optional authenticated pass using the public login pattern from the disclosed repro
if [[ -n "$USER" && -n "$PASS" ]]; then
  if PASSMD5="$(md5hex "$PASS")"; then
    post_form "$BASE_URL/login/Auth" "username=$USER&password=$PASSMD5" > /dev/null
    for path in / /index.html /status.html /overview.html /advance.html /wireless.html; do
      fetch "$BASE_URL$path" > "$BODY"
      if [[ -s "$BODY" ]]; then
        classify_from_body || true
      fi
    done
  fi
fi

# 3) Final heuristic: if it looks like a Tenda admin UI but we cannot prove firmware/hardware revision
fetch "$BASE_URL/" > "$BODY"
if contains_a18_markers; then
  echo "UNKNOWN"
  exit 2
fi

echo "UNKNOWN"
exit 2

Sources

1. NVD entry for CVE-2026-2877
2. Public reversing and reproduction issue
3. Tenda A18 support/download page
4. Tenda A18 setup guide showing local `re.tenda.cn` management flow
5. Tenda A18 Chinese FAQ showing local admin access flow
6. Tenda search page marking A18 line EOL
7. CISA Known Exploited Vulnerabilities catalog
8. CVEDetails entry with EPSS and reference aggregation