CVE-2026-24428
HighSummary
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows an authenticated low-privileged user to change the administrator password. The attack involves sending a crafted request directly to the user management API, bypassing role-based restrictions enforced by the web interface.
Risk Assessment
The risk to the organization is full takeover of the router by an unauthorized user, potentially leading to network integrity compromise, traffic interception, or further attacks on the infrastructure.
Recommendation
Immediately update the Tenda W30E router firmware to the latest available version if a patch is provided by the vendor. If no patch is available, restrict administrative interface access to trusted networks only and monitor logs for unusual password changes.
Other vulnerabilities in Tenda W30E
See all- CVE-2026-24440High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
- CVE-2026-24430High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) discloses sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
Original NVD description (English source)
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.