CVE-2026-118238

The Tenda W18E High-Power AP is vulnerable to OS command injection in its web management server (/bin/httpd) via the diagnose packet-capture feature. The vulnerability occurs because the formSetNetCheckTools function fails to validate shell metacharacters in the protocol and targetDevice JSON fie...