CVE-2018-14558: Tenda AC7, AC9 and AC10 routers command injection via setUsbUnload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an unauthenticated remote command injection with a CVSS score of 9.8 and confirmed exploitation in the wild per CISA KEV.

What it is

Tenda AC7, AC9 and AC10 router firmware contains an OS command injection flaw in the formsetUsbUnload function, which passes untrusted input from a crafted goform/setUsbUnload request to a dosystemCmd call. An unauthenticated remote attacker can therefore run arbitrary operating system commands on the device. The flaw is rated critical (CVSS 9.8) and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

Successful exploitation gives the attacker arbitrary command execution on the router, allowing full compromise of the device, its configuration and any traffic or credentials it handles. Because the device sits at the network edge, it can also serve as a foothold for further attacks on the internal network.

Attack surface

The flaw is reached over the network through an HTTP request to the goform/setUsbUnload endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

CVE-2018-14558 is listed in CISA KEV with a 2021-11-03 addition date, confirming exploitation in the wild, and EPSS shows a 30-day probability of 0.08742 (94.88th percentile). A public exploit reference exists, though the linked GitHub advisory is now marked as a broken link.

What to do

• Apply the vendor firmware updates for AC7, AC9 and AC10 as instructed in the CISA KEV required action; if no fixed firmware is available for a model, replace or retire the device.
• Do not expose the router's web management interface to the internet; restrict administrative access to trusted management networks.
• Segment or isolate these routers on the network so a compromised device cannot reach sensitive internal systems.
• Monitor vendor and CISA advisories for updated firmware and end-of-support notices for these models.

Detection

• Inspect HTTP request logs and network traffic for POST requests to /goform/setUsbUnload, especially those containing shell metacharacters or command strings.
• Alert on unexpected outbound connections or processes originating from the router, which may indicate command execution.
• Audit router configuration and firmware versions against the affected ranges to identify unpatched devices.
• Watch for signs of device tampering such as changed admin credentials, modified DNS settings or added services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.