PT-2026-4793 · Tenda · Tenda W30E

Kazuma Matsumoto · Published 2026-01-26 · Updated 2026-01-26 · CVE-2026-24436

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037)

Description The firmware does not implement rate limiting or account lockout features on authentication endpoints. This allows attackers to attempt unrestricted brute-force attacks against administrative credentials. The affected device is used in home and small office networks.

Recommendations Update to a firmware version newer than V16.01.0.19(5037).

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2026-00937

CVE-2026-24436

Affected Products

Tenda W30E

References · 8

• https://bdu.fstec.ru/vul/2026-00937 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24436 · Security Note
• https://twitter.com/0dayPublishing/status/2015895379363946946 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2015862016011882572 · Twitter Post
• https://tendacn.com/product/W30E · Note
• https://twitter.com/CVEnew/status/2015847101184541126 · Twitter Post
• https://vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authentication · Note