Tenda W18E CVE-2026-118238

The attacker must be able to reach the W18E web management server and invoke the 'diagnose' packet-capture feature, then supply a JSON body whose protocol or targetDevice field contains shell metacharacters; these are concatenated into a tcpdump command executed as root (CWE-78). In a normally configured device this requires an authenticated session (CVSS PR:H), which is the primary limiting factor; however, the description states that when the device is in a factory-reset (unconfigured) state the same injection can be performed without authentication. Confirmed affected build is W18E V16.01.0.20. Limiting factors for defenders: exposure of the management interface to the attacker, possession of valid credentials OR the device being in a factory-reset state, and the absence of input validation on those specific JSON fields.

This is a genuine high-impact issue but not an immediate fire drill based on the supplied signals, which are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H = 7.2 High) indicates a network-reachable, low-complexity flaw that yields total system compromise but requires high privileges, and SSVC agrees (Technical Impact: total, Exploitation: none, Automatable: no), producing a 'this_week' priority rather than an emergency. It is NOT in CISA KEV and SSVC reports no observed exploitation, so there is no evidence of active attacks; a public PoC reference (an exploit-development blog) exists but is not verified as working exploit code. The one notable tension is between the PR:H CVSS metric and the description's statement that the flaw is unauthenticated when the device is in a factory-reset state - these describe two different deployment conditions, so for a freshly reset or unconfigured device the real privilege barrier drops to none, materially raising risk even though the base vector scores PR:H. Automatable:no reflects that mass, unauthenticated internet-scale exploitation is not expected because the normal path needs admin-level access.

An attacker with authenticated access to the W18E web management interface (for example a low-trust internal user or someone who has obtained admin credentials) opens the 'diagnose' packet-capture feature and submits a JSON request with shell metacharacters embedded in the protocol or targetDevice field. Because these values are concatenated unsanitized into a tcpdump command run as root, the injected commands execute with root privileges, fully compromising the router. If the device is in a factory-reset state, the same request can be sent without authentication, and a public PoC reference exists though it is not verified as working exploit code.