{"id":"CVE-2026-118238","kind":"vulnerability","aliases":["CVE-2026-118238"],"related":[],"title":"Tenda W18E router: command injection via diagnose packet-capture feature","description":"The Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.","summary":"The Tenda W18E router web management server passes unvalidated JSON fields into a tcpdump shell command. An attacker who can reach the admin interface can run arbitrary OS commands as root.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tenda W18E","fixed":[],"affected":"16.01.0.20 (per aggregators, unconfirmed)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","routers","self-hosted","tenda","w18e"],"not_affected_if":["management-interface-not-reachable","not-w18e-hardware"],"how_to_check":"- In the W18E admin UI (System status), read the firmware version; V16.01.0.20 is the reported affected build, and other builds are unconfirmed.\n- Check whether the admin web interface is reachable from the internet or untrusted LAN segments (remote management / port forwards).\n- Any W18E still in factory-reset state with no admin password set can be treated as unauthenticated-exploitable; set an admin password now.","fix":null,"status":"open","published_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:33+00:00","updated_at":"2026-10-30T16:33:49+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-30T16:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Tenda W18E router: command injection via diagnose packet-capture feature","impact":"high","summary":"The Tenda W18E router web management server passes unvalidated JSON fields into a tcpdump shell command. An attacker who can reach the admin interface can run arbitrary OS commands as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["tenda","w18e","routers","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs arbitrary OS commands as root on the router","analyst_note":"Find affected firmware versions and any vendor fix; confirm whether factory-reset state exposes the diagnose endpoint without login, per the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118238.","how_to_check":"- Identify Tenda W18E devices on your network and note their firmware version (unknown in the sources)\n- Check whether the web management interface is reachable from outside your network (unknown in the sources)\n- Check whether any W18E is still in factory-reset state with default credentials (unknown in the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["management-interface-not-reachable","not-w18e-hardware"],"who_is_affected":"Tenda W18E devices with the web management server exposed. The description says exploitation needs an authenticated user, but also states it can be exploited without authentication if the device is in factory-reset state, so unconfigured devices are at higher risk. Teams running these routers on a network should check their management interface exposure. Sources do not name affected firmware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000724,"input_tokens":4152,"output_tokens":617,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected firmware versions and any vendor fix; confirm whether factory-reset state exposes the diagnose endpoint without login, per the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118238.","search":"'-118238':14A,17A '-2026':13A,16A 'admin':49B 'arbitrari':53B 'attack':44B 'authent':85C,116C 'captur':10A,75C 'command':4A,42B,55B,68C,104C 'concaten':100C 'cve':12A,15A 'devic':119C 'diagnos':7A,72C 'due':77C 'execut':106C 'exploit':114C 'factori':124C 'factory-reset':123C 'featur':11A,76C 'field':37B,83C,96C 'host':24B 'improp':79C 'infrastructur':20B 'inject':5A,69C,88C 'interfac':50B 'json':36B,82C 'later':99C 'manag':32B,62C 'metacharact':90C 'os':54B,67C 'packet':9A,74C 'packet-captur':8A,73C 'pass':34B 'privileg':109C 'protocol':93C 'reach':47B 'reset':125C 'root':57B,108C 'router':3A,21B,30B 'run':52B 'self':23B 'self-host':22B 'server':33B,63C 'shell':41B,89C 'state':126C 'targetdevic':95C 'tcpdump':40B,103C 'tenda':1A,18A,25B,28B,59C 'unvalid':35B 'user':86C 'valid':80C 'via':6A,70C 'vulner':65C,111C 'w18e':2A,19A,26B,29B,60C 'web':31B,61C 'without':115C","nicknames":[],"mitigations":[],"who_affected":"Tenda W18E routers running firmware reported as 16.01.0.20 whose web management interface can be reached by an attacker. An attacker needs a login, except on a device in factory-reset state, where no login is needed and commands run as root. Devices with the admin interface limited to a trusted network and a configured password are lower risk. Anyone without a W18E can skip it. No vendor fix or advisory was found.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118238","severity":null,"published_at":"2026-10-30T16:17:41+00:00","modified_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118238:1173","url":null,"severity":null,"published_at":"2026-10-30T16:33:49+00:00","modified_at":"2026-10-30T16:33:49+00:00","first_seen_at":"2026-10-30T16:33:49+00:00","fetched_at":"2026-10-30T16:33:49+00:00","note":"No vendor advisory found; Tenda page not located. NVD text: injection in protocol/targetDevice JSON fields into tcpdump, root; unauthenticated only in factory-reset state, else needs login. Aggregators (OffSeq, HOL) list affected V16.01.0.20, no fix; unconfirmed by vendor. Researcher JiuZero blog (2026-09-19, W18E V2.0 httpd, PoC suite) is password-locked, so unread. No exploitation reports. Nothing marked verified."}],"documents":[{"id":24658,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118238","title":"NVD CVE-2026-118238","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24659,"url":"https://radar.offseq.com/threat/cve-2026-118238-cwe-78-os-command-injection-in-tenda-w18e-d95143eccf2fd1cc","title":"OffSeq Threat Radar: CVE-2026-118238 (affected 16.01.0.20, no fix)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":24660,"url":"https://jiuzero.github.io/2026/09/19/Tenda-W18E-V2.0-httpd-Unauthenticated-OS-Command-Injection-in-the-Packet-Capture-Diagnostic-Feature-Root-RCE/","title":"JiuZero: Tenda W18E V2.0 httpd unauthenticated command injection (body password-locked)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}