{"id":"CVE-2026-118238","aliases":[],"cve":{"records":[{"id":"CVE-2026-118238","source":"certcc","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T19:49:03.088Z","published":"2026-10-30T15:08:41.752Z","modified":"2026-10-30T17:07:06.917Z"}],"publishers":[{"name":"certcc","role":"CNA","organizationId":"37e5125f-f79b-445b-8fad-9564f167944b","modified":"2026-10-30T15:08:41.752Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:07:06.917Z"}],"references":[{"url":"https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html","tags":[],"source":"certcc"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:07:03.133377Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"The Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields.","titleSource":"certcc","descriptionSource":"certcc","description":"The Tenda W18E web management server is vulnerable to OS command injection via the \"diagnose\" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.","score":7.2,"severity":"high","published":"2026-10-30T15:08:41.752Z","modified":"2026-10-30T17:07:06.917Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Tenda","name":"W18E","platforms":[],"versions":[{"version":"V16.01.0.20","status":"affected"}],"cpes":[],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-118238"}],"remediation":[],"references":["https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html"],"sources":[{"name":"CVE","id":"CVE-2026-118238","modified":"2026-10-30T17:07:06.917Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118238"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}],"sourceAffected":[],"observedAt":"2026-10-30T17:18:07.655Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T16:50:37.313Z","attemptedAt":"2026-10-30T16:50:37.313Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T16:50:37.422Z","attemptedAt":"2026-10-30T16:50:37.422Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T16:50:38.194Z","attemptedAt":"2026-10-30T16:50:38.194Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T16:50:37.311Z","attemptedAt":"2026-10-30T16:50:37.311Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118238","modified":"2026-10-30T16:17:41.993","checkedAt":"2026-10-30T16:50:37.313Z"}],"aiSummary":null}