PT-2026-4803 · Tenda · Tenda W30E

Kazuma Matsumoto · Publicado 2026-01-26 · Atualizado 2026-01-26 · CVE-2026-24439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037)

Description The web management interfaces of the affected device do not include the X-Content-Type-Options: nosniff response header. This can allow browsers that perform MIME sniffing to incorrectly interpret responses influenced by an attacker as executable script.

Recommendations Update to a firmware version newer than V16.01.0.19(5037).

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

BDU:2026-01031

CVE-2026-24439

Produtos afetados

Tenda W30E

Referências · 7

• https://twitter.com/CVEnew/status/2015856451768439101 · Publicação no Twitter
• https://vulncheck.com/advisories/tenda-w30e-v2-lacks-x-content-type-options-header · Nota
• https://bdu.fstec.ru/vul/2026-01031 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-24439 · Nota de Segurança
• https://tendacn.com/product/W30E · Nota
• https://osv.dev/vulnerability/CVE-2026-24439 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2015867135776481791 · Publicação no Twitter