# CVE-2026-51934: Tenda A18 buffer overflow in fromSetCmdlineRun

Source: https://junglewise.ai/threats/cve-2026-51934-tenda-a18-buffer-overflow-in-fromsetcmdlinerun  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-51934 · Severity: critical · CVSS 9.8 · Published 2026-09-01

The Tenda A18 is a wireless router used to provide internet connectivity to homes and small businesses. A buffer overflow vulnerability in its firmware allows a remote attacker to execute arbitrary code on the device, potentially compromising network security and enabling unauthorized access to connected devices and data.

Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-51934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51934 being exploited in the wild.

**How severe is CVE-2026-51934?** Critical severity, with a CVSS score of 9.8, published 1 September 2026.

**Which products and versions are affected?** Tenda A18 15.13.07.09.

**Is there a fix for CVE-2026-51934?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51934 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-51934?** Check whether you run Tenda A18 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a buffer overflow in the fromSetCmdlineRun function within Tenda A18 firmware version 15.13.07.09. The vulnerability can be triggered remotely without authentication, allowing an attacker to overflow a buffer and execute arbitrary code with device privileges. The attack vector is network-based, requiring no user interaction or authentication. Successful exploitation grants the attacker complete control over the router, enabling network interception, device compromise, and lateral movement into connected networks.

## Affected products

- Tenda A18 15.13.07.09

## Timeline

- 2026-09-01: disclosed

## References

- [http://shenzhen.com/](http://shenzhen.com/)
- [http://tenda.com/](http://tenda.com/)