PT-2026-4801 · Tenda · Tenda W30E V2

Kazuma Matsumoto · CVE-2026-24432 · Publicado 2026-01-26 · Atualizado 2026-01-26

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 versions up to and including V16.01.0.19(5037)

Description The device lacks cross-site request forgery (CSRF) protections on administrative endpoints. This allows an attacker to craft malicious requests that, when executed by an authenticated user, can modify administrative passwords and other configuration settings. The affected endpoints include those used to change administrator account credentials.

Recommendations Update to a version newer than V16.01.0.19(5037).

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2026-00917

CVE-2026-24432

Produtos afetados

Tenda W30E V2

Referências · 7

• https://vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions · Nota
• https://twitter.com/VulmonFeeds/status/2015874814280437813 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24432 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24432 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2015856453731434604 · Publicação no Twitter
• https://tendacn.com/product/W30E · Nota
• https://bdu.fstec.ru/vul/2026-00917 · Nota de Segurança