CVE-2026-38835

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-06-17
Weakness: CWE-77

Description

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

Shenzhen Tenda Technology Co., Ltd. W30E V2: 16.01.0.21

References

https://github.com/jsjbcyber/repo/blob/main/rep_2.md
https://github.com/jsjbcyber/repo/blob/main/rep_2.md

Get alerted when CVE-2026-38835 or the next vulnerability affects your stack