CVE-2026-118238
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Oct 30, 2026
Vendor
unknown
Description
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.