What is GHSA-26w6-cmwv-h7mc?

GHSA-26w6-cmwv-h7mc is a security advisory published by GitHub Security Advisories with High severity. The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose"...

Which CVE IDs does GHSA-26w6-cmwv-h7mc cover?

GHSA-26w6-cmwv-h7mc covers the following CVE IDs: CVE-2026-118238. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-26w6-cmwv-h7mc?

GHSA-26w6-cmwv-h7mc has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-26w6-cmwv-h7mcHighCVSS 7.2

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose"...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118238 →

📋 Description

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118238
https://cushz.github.io/en/exploit-development/2026/10/27/hacking-routers-for-fun-and-not-profit.html
https://github.com/advisories/GHSA-26w6-cmwv-h7mc