PT-2026-4789 · Tenda · Tenda W30E

Kazuma Matsumoto · Published 2026-01-26 · Updated 2026-01-29 · CVE-2026-24429

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037)

Description The device ships with a predefined default password for a built-in authentication account. This account does not require a password change during initial configuration. An attacker can use these default credentials to access the management interface with authenticated access.

Recommendations Update firmware to a version newer than V16.01.0.19(5037).

Fix

Weakness Enumeration

CWE-1393

Related Identifiers

BDU:2026-01036

CVE-2026-24429

Affected Products

Tenda W30E

References · 11

• https://bdu.fstec.ru/vul/2026-01036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24429 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24429 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2015865163035857232 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-2147 · Note
• https://vulncheck.com/advisories/tenda-w30e-v2-hardcoded-default-password-for-built-in-account · Note
• https://twitter.com/CVEnew/status/2015847105533985277 · Twitter Post
• https://t.me/cveNotify/150260 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0004 · Note
• https://twitter.com/VulmonFeeds/status/2015885051578175886 · Twitter Post
• https://tendacn.com/product/W30E · Note