CVE-2026-38834

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-06-17
Weakness: CWE-77

Description

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

Shenzhen Tenda Technology Co., Ltd. W30E V2: 16.01.0.21

References

https://github.com/jsjbcyber/repo/blob/main/rep_1.md
https://github.com/jsjbcyber/repo/blob/main/rep_1.md

Get alerted when CVE-2026-38834 or the next vulnerability affects your stack