CVE-2018-5767: Tenda AC15 router remote code execution via COOKIE header password parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent risk for exposed Tenda AC15 devices.

What it is

Tenda AC15 firmware V15.03.1.16_multi fails to properly validate the password parameter in the COOKIE header, allowing command injection. A remote, unauthenticated attacker can exploit this to execute arbitrary code on the device. The flaw is critical because it requires no credentials or user interaction and gives full control of the router.

Impact

An attacker gains remote code execution with the privileges of the affected service, allowing full compromise of the device. This can lead to persistent access, traffic interception, or use of the router as a pivot into the internal network.

Attack surface

The vulnerability is reachable over the network via HTTP requests to the router's web interface, specifically by crafting the password parameter in the COOKIE header. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit code exists (Exploit-DB 44253 and a technical advisory from Fidus InfoSec), and EPSS estimates a 47.4% probability of exploitation in the next 30 days (98.8th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the latest firmware update from Tenda for the AC15; if no patch is available, replace the device or isolate it from untrusted networks.
• Disable remote administration and restrict web interface access to trusted management networks only.
• Place the router behind a firewall that blocks inbound access to its web management port from the internet.
• Monitor vendor advisories for a fixed firmware version and upgrade as soon as it is released.
• If the device cannot be patched, consider network segmentation to limit lateral movement from a compromised router.

Detection

• Inspect HTTP request logs for COOKIE headers containing unusual characters or shell metacharacters in the password parameter.
• Monitor for outbound connections from the router to unexpected external IP addresses or command-and-control infrastructure.
• Use network intrusion detection signatures that flag known exploit patterns for CVE-2018-5767.
• Audit router configuration changes and unexpected process execution on the device if logging is available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.