{"id":"CVE-2026-118238","title":"CVE-2026-118238","summary":"The Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or ta…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-78"],"vendor":"Tenda","product":"W18E","affected":["W18E V16.01.0.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T17:07:03.133377Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:07:06.917Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118238","references":[{"url":"https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html"}],"tags":["cve.org","exploit-available"],"epss":0.01535,"epssPercentile":0.74901,"exploits":{"github":1,"githubRepos":["https://github.com/Cushz/CVE-2026-118238"],"checkedAt":"2026-11-05T16:25:07.449Z"},"ingestedAt":"2026-11-05T16:24:31.125Z","slug":"CVE-2026-118238","body":"## Overview\n\nThe Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.\n\n## Affected\n\n- `W18E V16.01.0.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[]}