OS Command Injection Vulnerability in Tenda W18E Web Management Server

CVE-2026-118238

What is CVE-2026-118238?

The Tenda W18E web management server is susceptible to OS command injection due to inadequate validation of JSON fields in its 'diagnose' packet-capture feature. An authenticated user can exploit this vulnerability by injecting shell metacharacters into the 'protocol' or 'targetDevice' fields, which are then concatenated into a tcpdump command executed with root privileges. Importantly, this vulnerability can also be exploited by unauthenticated users if the device remains in its factory-reset state, presenting a significant security risk.

References