Arbitrary Code Execution Vulnerability in Tenda W18E Router
CVE-2025-45343

9.8CRITICAL

Key Information:

Vendor

Tenda
Status
W18E Router
Vendor
CVE Published:
28 May 2025

What is CVE-2025-45343?

An issue in Tenda W18E v.2.0 v.16.01.0.11 allows attackers to exploit the account module's editing functionality to execute arbitrary commands. This vulnerability arises from insufficient validation in the goform/setmodules route, potentially leading to unauthorized actions or control over the device. Users are advised to update their devices to mitigate this risk.

References

https://www.tenda.com.cn/
http://w18e.com
https://gist.github.com/isstabber/b363d47966965e5c0a8ec26...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.