CVE-2026-24430

EUVD-2026-4679
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
tendaw30e_firmware
𝑥
≤ 16.01.0.19\(5037\)
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.tendacn.com/product/W30E
https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials