Vulnerability · Published Mar 20, 2026 · Assigned by VulDB
CVE-2026-4492Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow
High 8.8
In plain English
A high-severity stack buffer overflow in A18 Pro from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-352018 | Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow vdb-entry, technical-description
- VDB-352018 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #773682 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow third-party-advisory
- https://github.com/lilukun337/cve/issues/4 exploit, issue-tracking
- https://www.tenda.com.cn/ product