CVE-2026-118238: OS Command Injection
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Affected Software
Event History
Frequently Asked Questions
When can this be exploited without credentials?
The device can be exploited without authentication when it is in a factory-reset state. Otherwise, exploitation requires an authenticated user.
What level of access does successful exploitation provide?
Injected commands are executed with root privileges because the affected fields are incorporated into a tcpdump command run by the web management server. This can affect confidentiality, integrity, and availability.
Is exploit information publicly available?
Yes. A proof of concept is flagged, and an exploit was published on 2026-10-27.