CVE-2018-14558

Exploited in the wild. In CISA KEV since 2021‑11‑03. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile95th8.7% chance in 30 days CISA KEVListedsince 2021-11-03, due 2022-05-03
No public exploit known FixVendor fixNo build named by the sources

Published 2018-10-30Updated 2025-11-07Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Tenda AC7, AC9, or AC10 router’s current firmware version is within the affected range (AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, AC10 through V15.03.06.23_CN).
Verify whether the router’s web interface is reachable from outside your local network (for example, via the WAN/Internet), not just from your internal computers/phones.
If it is Internet-reachable, immediately block inbound access to the router’s web interface from the Internet using your firewall/router rules (allow only trusted internal IPs).
Contact your vendor/support channel and request the specific fixed firmware for CVE-2018-14558 for your exact model and current firmware; install it as soon as a version is provided.
If you cannot obtain a fixed firmware promptly, treat the device as compromised-risk: keep it isolated from the Internet and restrict all inbound management access until patched.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

In plain language

Written by AI from the record

This is a critical security hole in certain Tenda router firmware that lets an attacker take full control if they can reach the router’s web page—so yes, a typical small business should worry if your device is exposed to the network.

CVE-2018-14558 is an unauthenticated command injection in Tenda ac7 firmware, ac9 firmware, and ac10 firmware where a crafted HTTP request to the goform/setUsbUnload endpoint can inject shell commands for full remote control.

If you're affected

Full router takeover
Device used as malware proxy
Network disruption and downtime
Service theft via unauthorized use

What is it

Think of your router’s web page like a door with a “back-office” function. This bug lets a remote attacker send a specially crafted message and trick the router into running operating-system commands, without needing a login. That means they can effectively steer the router—like taking the keys to your building and using them to open other doors.

Who is affected

This matters if you use or manage Tenda routers running the affected ac7/ac9/ac10 firmware versions and the router’s web interface can be reached over the network. It does not require a login or user action to trigger. The risk is greatest when the device is reachable from the Internet (for example, if the management web page is exposed).

How urgent is it

This is an actively exploited, confirmed-KEV issue, so assume attackers can target your routers that are reachable over the network. The CISA listed it as known exploited and set a past remediation due date (2022-05-03), which means waiting increases the chance of real-world abuse. The real-world reporting also describes compromised internet-facing edge devices being repurposed for malicious proxy activity.

What to do — in detail

Identify exposure (quick checks)

Confirm the router model is one of: AC7, AC9, AC10.
Record the current firmware version.
Confirm whether your current firmware falls within the affected ranges:
- AC7: through V15.03.06.44_CN(AC7)
- AC9: through V15.03.05.19(6318)_CN(AC9)
- AC10: through V15.03.06.23_CN(AC10)

Confirm whether you can be attacked from outside

Determine if the router’s web interface is reachable from the Internet (WAN). Many small businesses accidentally expose it via remote management or port forwarding.
If you’re unsure, test from an external network (e.g., a phone on cellular) or ask your IT/admin to check firewall/NAT/port-forward rules for inbound access to the router’s management ports.

Immediate containment (do this before patching if Internet-reachable)

Block inbound Internet traffic to the router’s web management interface.
Restrict access so only approved internal IP addresses can reach management.
If you have a separate firewall in front, enforce the block there rather than relying only on the router.

Patch / vendor update

The provided findings do not include a specific fixed firmware version (“no fix/patch information available”).
Contact Tenda support or your reseller and request the remediation specifically for CVE-2018-14558 for your exact model and firmware line.
Apply the vendor’s instructions as soon as you receive the fixed firmware.

If patching is delayed

Keep the router isolated from direct Internet management access (management reachable only from inside the business).
Consider replacing or replacing the router if the vendor cannot provide a fixed update.

What to monitor after changes

Look for signs of abuse consistent with the reporting (for example, unusual outbound traffic patterns typical of proxying or malware activity).
Review router logs (if available) for suspicious requests to web endpoints related to USB unload functionality or other unusual management actions.

CISA guidance timing

CISA KEV remediation due date: 2022-05-03 (already passed), so treat this as urgent for any Internet-reachable devices.

Technical context

Severity: Critical (CVSS 9.8). Mechanism: unauthenticated command injection (CWE-78) in Tenda router firmware via a crafted HTTP request to goform/setUsbUnload that injects shell commands into the backend function (formsetUsbUnload calling a system command routine with untrusted input). Reachability: requires network access to the router’s web interface, and default configurations indicate it is reachable. Exploitation status: confirmed in CISA KEV (listed 2021-11-03) with a due date of 2022-05-03; real-world reporting indicates exploitation in the wild and describes turning internet-facing routers into SOCKS5 proxies by named actors. Exploit availability: no public exploit code on record. Patch status: no fix/patch information available in the provided findings, so upgrade guidance must come from vendor instructions for the exact model/firmware branch. EPSS: a prediction exists (trend falling), but confirmed KEV/news exploitation takes priority over prediction for urgency.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Listed as exploited in the wild since 2021-11-03.

US federal agencies must remediate by 2022-05-03.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

8.7% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2792 days, from the signal feeds we watch.

2026-06-22EPSS band changehigh → low
2025-11-07Record updated
2021-11-03Added to CISA KEV
2018-10-30Publishedweakness classified, att&ck mapped

Affected products

Shenzhen Tenda Technology Co., Ltd.commercial · CNaka tenda
- Tenda AC7Network DeviceOn-premNetworking Infrastructure / router-switch
- Tenda AC9Network DeviceOn-premNetworking Infrastructure / router-switch
- Tenda AC10Network DeviceOn-premNetworking Infrastructure / router-switch
tendacommercial · CN

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable