CVE-2025-45343
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in Tenda W18E router version 2.0 with firmware 16.01.0.11 allows remote arbitrary code execution. The flaw resides in the account editing functionality within the goform/setmodules route.
Risk Assessment
An attacker can gain full control over the device, compromising network confidentiality and integrity, and potentially using the router as a pivot for further attacks.
Recommendation
Immediately update the Tenda W18E router firmware to the latest available version. If no update is available, restrict administrative panel access to trusted IP addresses only.
Other vulnerabilities in Tenda W18E
See all- CVE-2026-118238High
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. The vulnerability can be exploited without authentication if the device is in a factory-reset state.
- CVE-2025-29217Medium
A stack overflow vulnerability was discovered in the Tenda W18E v2.0 running firmware v16.01.0.11, specifically in the wifiSSID parameter at the /goform/setModules endpoint. Attackers can cause a Denial of Service (DoS) by sending a crafted POST request.
Original NVD description (English source)
An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmodules route.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS