PT-2026-4803 · Tenda · Tenda W30E

Kazuma Matsumoto · Published 2026-01-26 · Updated 2026-01-26 · CVE-2026-24439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037)

Description The web management interfaces of the affected device do not include the X-Content-Type-Options: nosniff response header. This can allow browsers that perform MIME sniffing to incorrectly interpret responses influenced by an attacker as executable script.

Recommendations Update to a firmware version newer than V16.01.0.19(5037).

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-01031

CVE-2026-24439

Affected Products

Tenda W30E

References · 7

• https://bdu.fstec.ru/vul/2026-01031 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24439 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24439 · Vendor Advisory
• https://twitter.com/CVEnew/status/2015856451768439101 · Twitter Post
• https://vulncheck.com/advisories/tenda-w30e-v2-lacks-x-content-type-options-header · Note
• https://tendacn.com/product/W30E · Note
• https://twitter.com/VulmonFeeds/status/2015867135776481791 · Twitter Post