PT-2026-24098 · Tenda · Tenda W15E

Jhx-Ui · Publicado 2026-03-09 · Atualizado 2026-03-09 · CVE-2026-30140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda W15E version V02.03.01.26 cn

Description An incorrect access control issue exists that allows an unauthenticated attacker to access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint. This access enables the download of the configuration file, which contains administrator credentials in plaintext. Successful exploitation can lead to sensitive information disclosure and potential remote administrative access.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint.

Exploit

Correção

LPE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-30140

Produtos afetados

Tenda W15E

Referências · 5

• 🔥 https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30140 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-30140 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031137187035754921 · Publicação no Twitter
• https://t.me/CVEtracker/46932 · Publicação no Telegram