CVE-2025-11326: A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of…

PriorityP270high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.15%

63.0th percentile

A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of the argument wifi_chkHz can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tenda	ac18	—	—
tenda	ac18_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/goform/WifiMacFilterSet↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda WifiMacFilterSet wifi_chkHz Parameter Buffer Overflow Attempt (CVE-2025-11326)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:24; content:"/goform/WifiMacFilterSet"; fast_pattern; http.request_body; content:"wifi_chkHz|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WifiMacFilterSet.md; reference:cve,2025-11326; classtype:web-application-attack; sid:2065063; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_06, cve CVE_2025_11326, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Exploit traffic is HTTP POST to /goform/WifiMacFilterSet with a wifi_chkHz parameter value exceeding 100 characters (stack-based buffer overflow trigger). Match on request body containing 'wifi_chkHz=' followed by 100+ non-ampersand characters.
→The URI path /goform/WifiMacFilterSet has an exact byte size of 24; use bsize:24 in Suricata/Snort for precise URI matching to reduce false positives.
→Traffic is plaintext HTTP (not TLS); deploy detection at perimeter and internal network boundaries targeting inbound connections to networking equipment.
→MITRE ATT&CK mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application. Prioritize alerting on Tenda AC18 devices exposed to untrusted networks.

·Affected version is Tenda AC18 firmware 15.03.05.19(6318) only. Scope detection to this specific firmware version to avoid noise on other Tenda devices. ↗
·Public exploit code is available; treat any matching traffic as high-confidence active exploitation attempt, not just scanning. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.