Tenda W18E routers suffer from a command injection flaw in the web‑based packet‑capture service. The vulnerable fields – protocol and targetDevice – are concatenated into a tcpdump command without proper sanitization. An authenticated user can inject shell metacharacters, enabling execution of arbitrary commands with root privileges. Even when the device is in a factory‑reset state, lack of authentication allows exploitation, giving an attacker complete control over the router.

The flaw affects all Tenda W18E models installed with the default or unpatched firmware. No specific version range is listed, so users should assume the issue is present in all current releases until a vendor fix is released.

The CVSS score is 7.2, but the weakness provides remote attackers the ability to run any code as root. The known EPSS score is unavailable and the vulnerability is not included in CISA KEV, suggesting limited current exploitation activity. However, because the exploit is triggered via a web interface that may be exposed, the attack vector is likely local network or initial remote if port 80/443 is accessible. The lack of authentication on factory‑reset units further lowers the barrier to compromise.