Vulnerability · Published Mar 20, 2026 · Assigned by VulDB

CVE-2026-4493Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub_423B50 stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in A18 Pro from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Tenda A18 Pro 02.03.02.28. The impacted element is the function sub_423B50 of the file /goform/setMacFilterCfg of the component MAC Filtering Configuration Endpoint. Executing a manipulation of the argument deviceList can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
Tenda	A18 Pro	02.03.02.28

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-352019 | Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub_423B50 stack-based overflow vdb-entry, technical-description
VDB-352019 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #773727 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow third-party-advisory
https://github.com/lilukun337/cve/issues/5 exploit, issue-tracking
https://www.tenda.com.cn/ product