CVE-2024-57583: Critical Command Injection in Tenda AC18

CVE-2024-57583 is a critical severity command injection flaw (CVSS 9.8) in Tenda AC18 firmware V15.03.05.19. The usbName parameter of the formSetSambaConf function is mishandled. We could not confirm a fixed version, so check Tenda's download page for newer firmware and limit access to the admin interface.

What's affected

The record says Tenda AC18 V15.03.05.19 contains a command injection via the usbName parameter in the formSetSambaConf function. That function is the Samba and USB sharing configuration handler, and the parameter carries the USB share name.

This is one of a group of Tenda AC18 entries from the same researcher series, CVE-2024-57575 and CVE-2024-57579 through CVE-2024-57583. The write-up links to Tenda's firmware download page for the affected version. No Tenda advisory is linked, so a fixed version is not confirmed. Treat V15.03.05.19 as affected, and check Tenda's download page for any newer firmware for your exact hardware revision. Tenda sells several variants under similar names, so match the model and hardware version printed on the router label before you download anything.

How to check if you're exposed

Open the router's admin page and read the firmware version on the system status or upgrade screen. If it reads V15.03.05.19, you have the version in the record.

Then check exposure.

• Is remote web management enabled? On many routers this is a single checkbox. Turn it off unless you have a reason.
• Which devices can reach the admin page from the inside? Guest devices and smart home gadgets on the main network can all send requests to it.
• Is the admin password still the default or a weak one?

The vector in the record shows network access with no privileges required. The write-ups for this firmware show requests sent to the router's web interface, and some include a session cookie, so whether a login is needed may depend on the version. Do not treat the login page as a safe barrier.

What to do now

1. Check Tenda's download page for the AC18 and install firmware newer than V15.03.05.19 if it exists for your hardware revision.
2. Turn off remote web management so the admin interface cannot be reached from the internet.
3. Set a long, unique admin password and a strong Wi-Fi password.
4. Put guests and smart devices on a separate guest network, if the router allows it.
5. Replace the router if Tenda has stopped issuing firmware for it, since a model with no updates will not get a fix for this.
6. Check the router now and then for settings you did not make, such as DNS servers or port forwards.

Why it matters

The record classes this as CWE-77, command injection. The write-up says the value is passed directly to a function that runs a system command, with no input validation. A shell reads its command line as text, so a value that carries extra shell syntax can add commands of its own. The router then runs them with the privileges of its web server process, which on a consumer router is often root.

The vector in the record shows network access, low complexity and no privileges, with high impact on confidentiality, integrity and availability, so the score is 9.8. The KEV flag in the record is false. Consumer routers repeat this class of bug often, because the web handlers are written in C, parse many parameters and rarely get a security review. The practical advice is to keep the admin interface off the internet, update when firmware exists and replace devices that no longer get updates.

Quick check

Sources

• Researcher write-up for CVE-2024-57583

Last reviewed: 19 October 2026.