CVE-2026-118238
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. The vulnerability can be exploited without authentication if the device is in a factory-reset state.
Risk Assessment
An attacker can execute arbitrary commands with root privileges on the device, potentially leading to full compromise of the router and the network.
Recommendation
Update Tenda W18E firmware to a patched version, change default credentials, and do not leave the device in a factory-reset state unattended.
Other vulnerabilities in Tenda W18E
See all- CVE-2025-45343Critical
A vulnerability in Tenda W18E router version 2.0 with firmware 16.01.0.11 allows remote arbitrary code execution. The flaw resides in the account editing functionality within the goform/setmodules route.
- CVE-2025-29217Medium
A stack overflow vulnerability was discovered in the Tenda W18E v2.0 running firmware v16.01.0.11, specifically in the wifiSSID parameter at the /goform/setModules endpoint. Attackers can cause a Denial of Service (DoS) by sending a crafted POST request.
Original NVD description (English source)
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS