Is CVE-2018-14558 (Tenda AC7, AC9, and AC10 Routers Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2018-14558 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

What the CISA KEV listing means for this Tenda router flaw

CISA’s KEV inclusion is the strongest practical signal that this is not just a theoretical bug. For this vulnerability, the operational question is less about whether exploitation is possible and more about whether the affected router is still exposed, reachable, and trusted in your environment.

The best next step is to treat the router as an internet-facing or edge device until proven otherwise. If it is still in service, confirm the exact model and firmware lineage, then compare it against the vendor’s advisory rather than relying on inventory names alone. KEV status should move the issue into active remediation, not routine backlog handling.

For a broader baseline on how to prioritise findings like this, Zero-Day and Exploited Vulnerabilities Guide is the right internal starting point.

Why command injection on an edge router is operationally dangerous

Command injection on a gateway or router matters because it can turn a small exposed management surface into device-level execution. In practice, that can mean configuration tampering, traffic redirection, pivoting into adjacent networks, or implanting persistence on a device that often sits outside normal endpoint monitoring.

For consumer and small-office networking gear, the blast radius is often underestimated. These devices may be deployed with weak segmentation, reused admin access, or long patch delays, which makes exploitation more attractive than a bug inside a well-monitored server fleet.

IoT Security Guide helps frame why device security, segmentation, and firmware hygiene matter for connected edge hardware, even when the vulnerable component is a router rather than a sensor.

How to confirm exposure and reduce the chance of repeat compromise

Start by identifying every instance of the affected Tenda models across branches, home offices, labs, and spare stock. Then verify whether the vulnerable management interface is exposed internally or externally, whether remote administration is enabled, and whether the device has been factory-reset, replaced, or repurposed since deployment.

If patching is available, apply it after validation and then review whether the router was exposed during the vulnerable window. If patching must wait, isolate the device, restrict management access to trusted admin networks, and remove any unnecessary remote management paths. Because this is a command injection issue, you should also assume configuration integrity may have been affected if the device was reachable from an untrusted network.

For vulnerability triage and response sequencing, Vulnerability Management Guide is the most useful internal reference, and the CISA Known Exploited Vulnerabilities Catalog is the authoritative external prioritisation source.

Risk and Threat Considerations

Edge routers are high-value targets because they sit at a trust boundary and often receive less scrutiny than servers or laptops. When a command injection flaw is actively exploited, the likely threat is not only device disruption but also stealthy network access, configuration abuse, or reuse of the router as a foothold for later movement.

Failure mechanism: Untrusted input reaches a system command path, allowing an attacker to execute arbitrary commands through the router’s management or configuration logic.

Impact: The device can be repurposed for traffic interception, access persistence, lateral movement, or broader network compromise, especially if the router is also used as a remote administration anchor.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-12 — Network Infrastructure Management	Routers are network infrastructure that must be inventoried and remediated promptly.
	CIS-7 — Continuous Vulnerability Management	Active exploitation requires prioritised identification and remediation of the vulnerable routers.
Recommendation — Inventory affected routers and enforce timely secure configuration changes and patching. Prioritise KEV-listed router vulnerabilities for rapid patching or isolation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The flaw demands verified remediation and continued tracking until fixed.
	AC-4 — Information Flow Enforcement	Compromised edge devices can alter or redirect network flows.
	CM-6 — Configuration Settings	Command injection often succeeds through unsafe device configuration and exposed admin settings.
Recommendation — Apply and verify remediation for the vulnerable router firmware or configuration. Restrict router management and traffic paths to trusted administrative networks. Harden router management settings and remove unnecessary exposure paths.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Managed	This is a KEV-listed device flaw that must be identified and managed as exposure.
	PR.IP-12 — Vulnerability Management	The question is about exploited vulnerability handling on deployed equipment.
Recommendation — Track vulnerable routers as high-priority assets until exposure is removed. Use a vulnerability process that forces rapid action on exploited edge-device flaws.
OWASP ASVS	V4 — API and Web Service	The issue is command injection through a web-exposed management function.
Recommendation — Treat any exposed management interface as untrusted input and harden server-side execution.
OWASP API Security Top 10	API8 — Security Misconfiguration	Router management exposure and unsafe command handling reflect misconfiguration risk.
Recommendation — Review device management exposure and lock down unsafe defaults before redeployment.

Practitioner Guidance

What to prioritise: Inventory every affected Tenda unit first, then determine whether any instance is still internet-reachable or used as a remote access choke point. That is the fastest way to separate a contained exposure from a likely compromise path.

What to verify: After remediation, verify firmware state, management exposure, and configuration integrity, not just successful rebooting. For edge devices, a “patched” label is not enough if the box was already abused or still exposes an admin path.

Decision rule: If the device handled untrusted traffic while vulnerable, treat it as a potential compromise candidate and review for unauthorized configuration changes before returning it to normal service.

Practitioner takeaway: For KEV-listed router flaws, the key judgement is whether the device was merely vulnerable or actually part of your trust boundary, because that decides whether you only patch it or also investigate the network path it may have exposed.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org