CVE-2026-24430
HighSummary
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) discloses sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
Risk Assessment
The risk to the organization is that administrator passwords and other credentials can be intercepted by third parties on the local network, potentially leading to unauthorized access to the router and further compromise of the network infrastructure.
Recommendation
It is recommended to immediately update the Tenda W30E router firmware to a version newer than V16.01.0.19(5037) if available, and to configure access to the management interface only via encrypted HTTPS or restrict access to trusted IP addresses.
Other vulnerabilities in Tenda W30E
See all- CVE-2026-24440High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
- CVE-2026-24428High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows an authenticated low-privileged user to change the administrator password. The attack involves sending a crafted request directly to the user management API, bypassing role-based restrictions enforced by the web interface.
Original NVD description (English source)
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.