W18E
Monthly
OS command injection in the Tenda W18E web management server lets an attacker who can reach the 'diagnose' packet-capture feature inject shell metacharacters through the JSON 'protocol' or 'targetDevice' fields, which are concatenated into a tcpdump command executed with root privileges and therefore yield full compromise of confidentiality, integrity and availability. In a normally configured device the injection requires an authenticated session (CVSS PR:H), but the description states the same path is reachable without authentication while the unit is in a factory-reset, unconfigured state; the confirmed affected build is W18E V16.01.0.20. Exploitation is not confirmed active (CISA KEV status is absent and SSVC exploitation is 'none' with automatable 'no'), although a public exploit-development writeup is referenced for this target; that reference is not verified as working exploit code, and no EPSS score was supplied.
OS command injection in the Tenda W18E web management server lets an attacker who can reach the 'diagnose' packet-capture feature inject shell metacharacters through the JSON 'protocol' or 'targetDevice' fields, which are concatenated into a tcpdump command executed with root privileges and therefore yield full compromise of confidentiality, integrity and availability. In a normally configured device the injection requires an authenticated session (CVSS PR:H), but the description states the same path is reachable without authentication while the unit is in a factory-reset, unconfigured state; the confirmed affected build is W18E V16.01.0.20. Exploitation is not confirmed active (CISA KEV status is absent and SSVC exploitation is 'none' with automatable 'no'), although a public exploit-development writeup is referenced for this target; that reference is not verified as working exploit code, and no EPSS score was supplied.