CVE-2025-5606 is a medium severity command injection flaw (CVSS 6.3) in Tenda AC18 firmware 15.03.05.05. It is reachable over the network and needs a low privilege account. No fixed version is named in the record, so isolate the product, restrict access and check the vendor for an update.
What's affected
The record lists Tenda AC18 firmware 15.03.05.05. The affected code is the function formSetIptv in /goform/SetIPTVCfg, and the argument list is the one the flaw depends on.
The NVD description was published on 2025-06-04. NVD rates it MEDIUM with a base score of 6.3. The vector shows attack complexity low, no user interaction, and impact of confidentiality low, integrity low, availability low.
Fixed versions: not stated in the record or in the pages we could read. We cannot confirm a patched release, so the vendor's advisory page or support channel should be checked directly. Do not assume a later version number is safe without a vendor statement.
The record also says the exploit has been disclosed to the public and may be used. It is not marked as exploited in the wild: the CISA Known Exploited Vulnerabilities flag in the record is false.
How to check if you're exposed
Log in to the device's web interface and read the firmware version on the status or system page. The record names firmware 15.03.05.05. Compare the model name too, since this CVE is specific to the Tenda AC18 Router.
Then check whether remote management is enabled. From a machine outside your network, the router's web management port should not answer. If it does, turn remote administration off in the device settings. If you cannot find the setting, the vendor's support site is the place to ask.
What to do now
- List every Tenda AC18 Router in use and its firmware version.
- Turn off remote administration and remove port forwards to the management interface.
- Check the vendor's download and support pages for firmware newer than the version in the record. None is named, so confirm the fix with the vendor.
- Restrict the web interface to a trusted wired segment, and change the administrator password if it is shared or old.
- After any firmware update, check the version again and confirm remote management is still off.
- If the vendor offers no fix, plan to replace the unit.
Why it matters
This is command injection. The classes are CWE-74 (injection, where input is passed to a downstream interpreter without being neutralised); CWE-77 (command injection). A web form handler in the router passes the value of list toward an operating system command without enough checking. Input that was meant to be a plain network value can end up interpreted as part of a command.
On a router, the command runs with the rights of the device's management process, which is usually root. That is why such flaws on consumer and small office gear matter even at a score of 7.3. A compromised router sees and can alter the traffic of everything behind it.
The record says the product is out of support. That turns a patching question into a replacement question.
Quick check
Does turning off remote administration remove the risk?
It removes the internet facing path, which matters most. Anyone on the local network may still reach the web interface, so keep that segment trusted.
Is there a firmware fix?
The record does not name one. Check the vendor's support site and confirm the version in writing if you can.
Sources
Check your own dependencies with the free in-browser scan at gold.safeguard.sh/scan. It reads manifests you give it, so it will not see a router or a standalone server, but it is a quick way to cover the code you ship.
Last reviewed: 18 October 2026.
