Live › vulnerability › CVE-2026-118238
The Tenda W18E router web management server passes unvalidated JSON fields into a tcpdump shell command. An attacker who can reach the admin interface can run arbitrary OS commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Tenda W18E routers running firmware reported as 16.01.0.20 whose web management interface can be reached by an attacker. An attacker needs a login, except on a device in factory-reset state, where no login is needed and commands run as root. Devices with the admin interface limited to a trusted network and a configured password are lower risk. Anyone without a W18E can skip it. No vendor fix or advisory was found.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Tenda W18E | vendor | 16.01.0.20 (per aggregators, unconfirmed) | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
This page as .md · .json · in your agent: get_signal("CVE-2026-118238")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.