PT-2026-24098 · Tenda · Tenda W15E

Jhx-Ui · Published 2026-03-09 · Updated 2026-03-09 · CVE-2026-30140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda W15E version V02.03.01.26 cn

Description An incorrect access control issue exists that allows an unauthenticated attacker to access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint. This access enables the download of the configuration file, which contains administrator credentials in plaintext. Successful exploitation can lead to sensitive information disclosure and potential remote administrative access.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-30140

Affected Products

Tenda W15E

References · 5

• 🔥 https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30140 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30140 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031137187035754921 · Twitter Post
• https://t.me/CVEtracker/46932 · Telegram Post