What is GHSA-f7fp-jm38-ghww?

GHSA-f7fp-jm38-ghww is a security advisory published by GitHub Security Advisories with Medium severity. An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set...

Which CVE IDs does GHSA-f7fp-jm38-ghww cover?

GHSA-f7fp-jm38-ghww covers the following CVE IDs: CVE-2026-38142. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f7fp-jm38-ghww?

GHSA-f7fp-jm38-ghww has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-f7fp-jm38-ghwwMediumCVSS 6.5

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set...

Vendor

GitHub Security Advisories

Published

July 1, 2026

Last Modified

July 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-38142 →

📋 Description

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-38142
https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/blob/main/Tenda%20AC18%20Unauthenticated%20Second-Order%20OS%20Command%20Injection%20in%20goformfast_setting_internet_set.pdf
https://github.com/advisories/GHSA-f7fp-jm38-ghww