{"id":"CVE-2026-118238","published":"2026-10-30T16:17:41.993","lastModified":"2026-10-30T17:17:15.473","description":"The Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}