CVE-2026-31255 is a critical command injection flaw (CVSS 9.8) in the /goform/SetSambaCfg interface of the Tenda AC18, firmware V15.03.05.05. The guestuser parameter is handled improperly. The record names no fix, so check with Tenda.
What's affected
The record names the Tenda AC18 with firmware V15.03.05.05_multi. It does not give a fixed version or say whether other versions are affected.
How to check if you're exposed
Sign in to the router and read the firmware version on the system status page. Compare it with V15.03.05.05.
Check whether the Samba file sharing feature is turned on and whether the admin page can be reached from the WAN side.
What to do now
- Look on Tenda's support site for a newer firmware for the AC18 and install it if it exists.
- Turn off remote management and turn off Samba sharing if you do not use it.
- Restrict access to the admin page to a trusted wired host.
- Replace the router if the vendor ships no fix.
Why it matters
The weakness class is CWE-77, command injection. The guestuser value is used inside a system command without being neutralized, so crafted input can add commands of its own. Home and small office routers run these handlers with high privileges.
The only reference is a public write up that I did not rely on for details. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does turning off Samba help?
The flaw sits in the Samba configuration interface, so disabling the feature and blocking access to the admin page lowers the exposure. It is not a substitute for a fix.
Sources
Last reviewed: 19 October 2026.
