What is the CVSS score of CVE-2026-24430?

CVE-2026-24430 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of W30e Firmware are affected by CVE-2026-24430?

Tenda W30E V2 wireless devices expose administrator credentials in cleartext through their maintenance interface, creating immediate risk of unauthorized network access and data compromise.

How to fix or mitigate CVE-2026-24430?

Within 24 hours: Identify all Tenda W30E V2 devices in your environment and document firmware versions; isolate devices from production networks if possible and restrict maintenance interface access to trusted networks only. Within 7 days: Disable the maintenance interface if operationally feasible; if required, change all admin credentials immediately and rotate any credentials that may have been exposed. Within 30 days: Replace affected devices with patched alternatives or devices from vendors with active security support; escalate to procurement to prevent future purchases of unsupported hardware.

W30e Firmware CVE-2026-24430

HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-01-26 disclosure@vulncheck.com

Information Disclosure Tenda W30e Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 26, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.

AnalysisAI

Shenzhen Tenda W30E V2 firmware through V16.01.0.19(5037) transmits administrative credentials in plaintext over unencrypted HTTP from the maintenance interface, allowing unauthenticated network attackers to intercept and obtain account credentials. Affected devices lack authentication requirements for accessing this interface, making credential theft trivial for anyone on the same network. No patch is currently available for this vulnerability.

Technical ContextAI

Affects W30E Firmware. Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.