SZB-ca6e6ac86c
Tenda W18E command injection in diagnose feature rated 7.2 in EUVD entry
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Tenda
- Product
- W18E
- First seen
Summary
The EUVD entry EUVD-2026-114093 reports OS command injection in the Tenda W18E web management server's "diagnose" packet-capture feature, scored 7.2 under CVSS v3.1. Per the item, an authenticated user can inject shell metacharacters through JSON fields.
If you use Tenda
Check Tenda's site for a firmware update fixing this issue
Restrict access to the web management interface to trusted users
Change administrator credentials and disable remote management if not needed
What the sources say 1
· Mastodon: “The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields.” Source