What is the CVSS score of CVE-2026-24436?

CVE-2026-24436 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-24436?

Within 24 hours: Inventory all Tenda W30E V2 devices and firmware versions in your environment; change all default and administrative credentials to complex, unique passwords; restrict administrative interface access to trusted IP ranges only. Within 7 days: Isolate affected devices to a segmented network if patching is not immediately possible; monitor access logs for brute-force attempts; disable remote management features if not operationally critical. Within 30 days: Develop a device replacement plan; evaluate alternative network equipment; implement network access controls and multi-factor authentication where possible.

W30e Firmware CVE-2026-24436

CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-01-26 disclosure@vulncheck.com

Authentication Bypass Tenda W30e Firmware

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Enumerate Tenda W30E V2 authentication endpoint
Delivery

Send rapid credential guesses
Exploit

Bypass absent rate limiting
Execution

Gain administrative access
Impact

Execute firmware modifications

Vulnerability Assessment

Weakness	CWE CWE-307 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Brute-force prevention, rate limiting
Exploitation Conditions	Tenda W30E V2 running firmware V16.01.0.19(5037) or earlier with authentication endpoints accessible without rate limiting or account lockout protections enabled.
Impact	CVSS 9.8. Combined with default credentials CVE, the router has no effective authentication security.
Exploit ScenarioDerived	Automated brute-force tool cracks password in minutes due to no rate limiting.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Missing rate limiting and account lockout on Tenda W30E V2 authentication endpoints. Brute-force attacks are unrestricted.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:00 CVSS 9.8

No brute-force protection on Tenda W30E V2.

RemediationAI

Update firmware. Implement account lockout.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-307 in Tenda W30E V2. No rate limiting or lockout mechanisms on login.

Know when W30e Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.

Executive ViewAI

Why It Matters

Shenzhen Tenda W30E V2 routers are vulnerable to unrestricted brute-force attacks against administrative accounts due to missing rate limiting controls. Any organization using affected firmware versions faces immediate risk of unauthorized administrative access, potentially leading to network compromise, data theft, and operational disruption.

Business Impact: Severe

Compensating Controls

Implement network-based rate limiting and IP blocking via firewall/WAF to restrict authentication attempts to administrative interfaces; segment Tenda devices to isolated VLANs with restricted inbound access; disable remote management and WAN-side administrative access; deploy intrusion detection/prevention systems to detect brute-force patterns; enforce strong password policies and disable default credentials; implement network access control (NAC) to limit device connectivity; monitor authentication logs for suspicious activity. Note: No vendor patch is currently available; compensating controls are mandatory.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*

More in W30e Firmware

View all

CVE-2024-32286 CRITICAL Act Now POC

9.8 Apr 17

Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVir

CVE-2023-49411 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode. Rated critical

CVE-2023-49406 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet

CVE-2023-49405 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg. Rated critical sever

CVE-2023-49404 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet. Rated c

CVE-2023-50002 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode. Rated criti

CVE-2023-50001 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline. Rated cr

CVE-2023-50000 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode. Rated critic

CVE-2023-49999 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPa

CVE-2023-49410 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status

CVE-2023-49403 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools. R

CVE-2023-49402 CRITICAL Act Now POC

9.8 Dec 07

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg. Rated critical severi

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all

CVE-2022-33106 CRITICAL POC

9.8

CVE-2026-44596 CRITICAL POC

9.8

CVE-2024-43042 CRITICAL POC

9.8

CVE-2024-39225 CRITICAL POC

9.8

CVE-2024-24767 CRITICAL POC

9.8

CVE-2023-6272 CRITICAL POC

9.8

CVE-2023-6756 CRITICAL POC

9.8

CVE-2023-49443 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

REF https://www.tendacn.com/product/W30E REF https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authentication

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back