CVE-2023-46370

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
n/an/an/a
tendaw18e_firmware16.01.0.8\(1576\)

References

Timeline

Published
Oct 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-463719.8TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.CVE-2023-463739.8TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses.CVE-2023-463746.1ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).CVE-2023-463758.8ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-463767.5Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.CVE-2023-463785.4Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-aCVE-2023-463807.5LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change reCVE-2023-463818.2LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication forCVE-2023-463827.5LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for CVE-2023-463837.5LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-eCVE-2023-463847.5LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remoCVE-2023-463857.5LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of
CVE-2023-46370: Critical severity, CVSS 9.8 | Vulnix