CVE-2025-57085
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Risk Assessment
An attacker can remotely cause the device to hang or reboot, disrupting network availability.
Recommendation
Update the Tenda W30E firmware to the latest version or restrict access to the management interface.
Other vulnerabilities in Tenda W30E
See all- CVE-2026-24440High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
- CVE-2026-24430High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) discloses sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
- CVE-2026-24428High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows an authenticated low-privileged user to change the administrator password. The attack involves sending a crafted request directly to the user management API, bypassing role-based restrictions enforced by the web interface.
- CVE-2025-57086High
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CVE-2025-57087High
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Original NVD description (English source)
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS