PT-2026-4791 · Tenda · Tenda W30E V2

Published 2026-01-26 · Updated 2026-01-26 · CVE-2026-24431

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037)

Description The firmware for the Shenzhen Tenda W30E V2 device stores user account passwords in plaintext within the administrative web interface. This allows any user with access to the affected management pages to view stored credentials directly.

Recommendations Update firmware to a version newer than V16.01.0.19(5037).

Fix

Weakness Enumeration

CWE-317

Related Identifiers

BDU:2026-01032

CVE-2026-24431

Affected Products

Tenda W30E V2

References · 6

• https://bdu.fstec.ru/vul/2026-01032 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24431 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24431 · Vendor Advisory
• https://twitter.com/CVEnew/status/2015856466150691312 · Twitter Post
• https://vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions · Note
• https://tendacn.com/product/W30E · Note