CVE-2026-24440
HighSummary
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
Risk Assessment
The risk is that an unauthorized user with access to the maintenance interface can change account passwords, potentially gaining control over the device. This could compromise network integrity and lead to further attacks.
Recommendation
It is recommended to immediately update the firmware to a version newer than V16.01.0.19(5037) if a patch is available. Additionally, restrict access to the maintenance interface to trusted networks and apply additional authentication mechanisms.
Other vulnerabilities in Tenda W30E
See all- CVE-2026-24430High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) discloses sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
- CVE-2026-24428High
A vulnerability in Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allows an authenticated low-privileged user to change the administrator password. The attack involves sending a crafted request directly to the user management API, bypassing role-based restrictions enforced by the web interface.
Original NVD description (English source)
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.