PT-2026-4801 · Tenda · Tenda W30E V2

Kazuma Matsumoto · Published 2026-01-26 · Updated 2026-01-26 · CVE-2026-24432

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 versions up to and including V16.01.0.19(5037)

Description The device lacks cross-site request forgery (CSRF) protections on administrative endpoints. This allows an attacker to craft malicious requests that, when executed by an authenticated user, can modify administrative passwords and other configuration settings. The affected endpoints include those used to change administrator account credentials.

Recommendations Update to a version newer than V16.01.0.19(5037).

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2026-00917

CVE-2026-24432

Affected Products

Tenda W30E V2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-24432 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24432 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00917 · Security Note
• https://vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions · Note
• https://twitter.com/VulmonFeeds/status/2015874814280437813 · Twitter Post
• https://twitter.com/CVEnew/status/2015856453731434604 · Twitter Post
• https://tendacn.com/product/W30E · Note