CVE-2026-118238

HIGH 7.2CVE-2026-118238 · Published 30/10/2026 · updated 30/10/2026

In short

CVE-2026-118238 is a HIGH (CVSS 7.2) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

References

cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free