CVE-2018-14558

CWE-78

Critical

101.6

RPS

Description

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

Source: NVD

CVSS: 9.8; Critical · v3.1
EPSS: 8.74%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Nov 2021
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-78
Published: 30 Oct 2018; Last modified 7 Nov 2025

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2018-14558

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2018-14558

Description

Signals

Get this score from the API