Threats tagged 'ghsa-26w6-cmwv-h7mc'

The Tenda W18E router's web management server has an OS command injection vulnerability in its "diagnose" packet-capture feature. This flaw arises from improper validation of JSON input fields, allowing an authenticated user to inject shell metacharacters into parameters that are executed with root privileges. Notably, the vulnerability can be exploited without authentication if the device is in a factory-reset state.