CVE-2026-118238

CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

Affected

Tenda · W18E

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.54% chance of exploitation in the next 30 days, 75th percentile

Published

2026-10-30

Proof-of-concept exploits (2)

• Cushz/CVE-2026-118238Repo stars 0★ · pushed 2026-10-27 · find archive
  3 files

  harness/build_and_run.shharness/sercon.pypoc.sh
• https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not…find archive

References

• CVE Record
• NVD entry