CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

• CWE-78

• https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118194The Page and Post Restriction plugin for WordPress is vulner…6.5
• CVE-2026-1182GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-11820A flaw was found in the community.general Ansible collection…6.5
• CVE-2026-11821The Eventin – Event Calendar, Event Registration, Tickets & …5.4
• CVE-2026-11822SQLite before 3.53.2 contains an out-of-bounds read vulnerab…5.5
• CVE-2026-11823The BookingPress Appointment Booking Pro plugin for WordPres…7.5
• CVE-2026-11824SQLite before 3.53.2 contains a heap-based buffer overflow v…7.8
• CVE-2026-118242Highcharts JS is a JavaScript charting library based on SVG.…8.5
• CVE-2026-118243Highcharts JS is a JavaScript charting library based on SVG.…5.3
• CVE-2026-118244Highcharts JS is a JavaScript charting library based on SVG.…7.2
• CVE-2026-118245Highcharts JS is a JavaScript charting library based on SVG.…8.6
• CVE-2026-118246Highcharts JS is a JavaScript charting library based on SVG.…8.4