CVE-2026-24431: Tenda W30E V2 Web UI Reveals Passwords in Cleartext

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-26 · updated 2026-06-17
Weakness: CWE-317

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials.

Affected products

Shenzhen Tenda Technology Co., Ltd. W30E V2: through 16.01.0.19\(5037\)

References

https://www.tendacn.com/product/W30E
https://www.vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions

Get alerted when CVE-2026-24431 or the next vulnerability affects your stack