CVE-2026-118238
Tenda W18E High-Power AP devices, tested on firmware US_W18EV2_kf_V16.01.0.20(4766)_HighPower, are described as affected. The checked facts list no vendor rating and no fix.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Tenda W18E router's web management server is affected, and an attacker can exploit improper input validation in its packet-capture diagnostic feature to run arbitrary operating system commands with root privileges. This could allow complete takeover of the device, and the flaw can be reached without logging in when the device is in its factory-reset state.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Tenda W18E
V16.01.0.20
References 2
GitHub · Cushz/CVE-2026-118238
Questions about CVE-2026-118238
What does this mean?
The device's network check and packet capture diagnose feature stores user-supplied JSON fields and places them into a tcpdump shell command. Crafted input can therefore run arbitrary shell commands as root, which the facts say can lead to full device takeover.Source: github.com
Am I affected, and how do I check?
The affected product is the Tenda W18E High-Power AP, tested on firmware US_W18EV2_kf_V16.01.0.20(4766)_HighPower. To check a device, compare its firmware version with that string and look at the value of quickset.done. Per the facts, no login is needed only while quickset.done is 0 (factory or post-reset state); otherwise a valid session is required.Source: github.com
What should I do about it?
The checked facts list no fixed firmware version, so no upgrade target can be named from them.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data
What if there's no patch?
The checked facts list no workaround. The facts do identify the vulnerable feature as the diagnose module's network check and packet capture, and the unauthenticated condition applies only while quickset.done is 0.Source: github.com
Why do the sources disagree?
The description says the flaw can be reached without authentication, while the CVSS vector lists PR:H, which means high privileges are required. The checked facts record this as a conflict and do not resolve it.Source: github.com