CVE-2026-24436

Critical

Published: 26/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Shenzhen Tenda W30E V2 firmware up to V16.01.0.19(5037) does not enforce rate limiting or account lockout on authentication endpoints, allowing unrestricted brute-force attacks against administrative credentials.

Risk Assessment

An attacker could guess the administrator password and gain full control of the device.

Recommendation

Apply a firmware update if available, or implement additional protections such as rate limiting and account lockout.

Original NVD description (English source)

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.