Tenda AC18 firmware upgrade handler vulnerable to critical CVE‑2026‑129258

A critical vulnerability (CVE‑2026‑129258) was added to the public CVE feed on Nov 14 2026, affecting the Tenda AC18 firmware upgrade handler. The NVD record lists a CVSS score of 9.1 and notes that manipulation of the `upgradeFile` argument leads to insufficient verification of data authenticity, enabling remote exploitation. No vendor advisory or CISA KEV entry has been issued, and there is no evidence of active exploitation in the wild. The flaw is high‑severity and unpatched, so any AC18 device that accepts unsigned firmware updates is at risk. Monitor Tenda’s official channels for an advisory or patch, and in the meantime restrict firmware upload access or enforce signed‑firmware checks until a fix is released. For details, see CVE‑2026‑129258.