CVE-2025-8182 json
Tenda AC18 Samba smb.conf weak password
published 2025-07-26 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22790
- cvss
- 5.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- notion.so https://www.notion.so/23a54a1113e7802abfabf1275a555f48 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 3.0 | 5.6 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 2.0 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 2.9 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 2.0 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Affected products
- Tenda AC18
Classification
- Weakness
-
- CWE-521 Weak Password Requirements
References
-
notion.so
/23a54a1113e7802abfabf1275a555f48
exploit, third-party-advisory
-
vuldb.com
/?id.317596
vdb-entry, third-party-advisory
-
vuldb.com
/?ctiid.317596
signature, permissions-required
-
vuldb.com
/?submit.621977
third-party-advisory, vdb-entry
-
tenda.com.cn
/
product
Sources
- CVE List CVE-2025-8182
- NVD CVE-2025-8182
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.