CVE-2018-14558

What is Tenda AC7/AC9/AC10?

Tenda is a Chinese manufacturer of low-cost consumer and small-office networking gear, and the AC7, AC9, and AC10 are budget dual-band Wi-Fi routers sold widely worldwide through retail and online marketplaces. Like many consumer router lines, they run a Linux-based firmware with a web management interface intended for use only on the local network — but weak input handling in that interface, combined with routers frequently being left exposed or having UPnP/remote-management enabled, makes them an attractive, high-volume target for IoT botnet operators.

Overview

CVE-2018-14558 is an OS command injection vulnerability in the web management interface of Tenda AC7, AC9, and AC10 routers. The formSetUsbUnload handler, which is meant to safely eject a USB storage device attached to the router, passes attacker-supplied input directly into a doSystemCmd function without sanitization, allowing an attacker to inject and execute arbitrary shell commands via a crafted goform/setUsbUnload request.

Technical Details

The root cause (CWE-78, OS Command Injection) is that the USB-unload parameter value is concatenated directly into a system shell command rather than being passed as a discrete, escaped argument or validated against an allowlist. Since the endpoint is reachable through the router's standard HTTP management interface and requires no meaningful input validation bypass, a single crafted request yields command execution with the privileges of the web management process — typically root on embedded router firmware (CVSS 9.8: no auth, no user interaction, network vector, low complexity).

Discovery

The vulnerability was identified and disclosed through public vulnerability research into consumer router firmware; no specific named researcher disclosure is confidently documented for this CVE beyond the CVE/NVD record itself.

Exploitation Context

CISA's KEV entry confirms real-world exploitation. Command injection bugs in consumer router web interfaces like this one are a longstanding staple of IoT botnet malware families (in the lineage of Mirai and its many forks), which continuously scan the internet for exposed router management interfaces to recruit devices for DDoS and further scanning activity.

Remediation

1. Update Tenda AC7/AC9/AC10 firmware to the latest version offered by Tenda for your specific hardware revision.
2. If no fix is available for your hardware revision, disable remote/WAN-facing management access and restrict the web interface to the local trusted network only.
3. Disable UPnP and any port-forwarding rules that might expose the router's management interface to the internet.
4. Replace end-of-life hardware that no longer receives firmware updates, particularly for business use.
5. Monitor outbound traffic from home/small-office routers for botnet check-in patterns if compromise is suspected.