W18E vulnerabilities

1 known vulnerability in W18E from Tenda. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  W18E: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-118238Oct 30, 2026TendaEPSS 1.54%

  The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, whic