CVE-2025-57087

A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.

A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) discloses sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.

A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows an authenticated low-privileged user to change the administrator password. The attack involves sending a crafted request directly to the user management API, bypassing role-based restrictions enforced by the web interface.

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.