PT-2026-34016 · Tenda · W30E Firmware

Jsjbcyber · Published 2026-04-21 · Updated 2026-04-27 · CVE-2026-38834

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tenda W30E V2.0 version V16.01.0.21

Description Command injection is possible in the do ping action() function through the hostName parameter. This allows attackers to execute arbitrary commands by sending a crafted request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-38834

Affected Products

W30E Firmware

References · 5

• 🔥 https://github.com/jsjbcyber/repo/blob/main/rep_1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38834 · Security Note
• https://t.me/cveNotify/161118 · Telegram Post
• https://twitter.com/infoflowcloud/status/2048911756940976326 · Twitter Post
• https://twitter.com/CVEnew/status/2048910167044214904 · Twitter Post