Tenda W18E vulnerabilities

A vulnerability in Tenda W18E router version 2.0 with firmware 16.01.0.11 allows remote arbitrary code execution. The flaw resides in the account editing functionality within the goform/setmodules route.

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. The vulnerability can be exploited without authentication if the device is in a factory-reset state.

A stack overflow vulnerability was discovered in the Tenda W18E v2.0 running firmware v16.01.0.11, specifically in the wifiSSID parameter at the /goform/setModules endpoint. Attackers can cause a Denial of Service (DoS) by sending a crafted POST request.