What is the CVSS score of CVE-2026-24440?

CVE-2026-24440 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of W30e Firmware are affected by CVE-2026-24440?

Tenda W30E V2 routers are vulnerable to unauthorized password changes, allowing attackers with physical or network access to take control of affected devices without authentication.

How to fix or mitigate CVE-2026-24440?

Within 24 hours: Inventory all Tenda W30E V2 devices running firmware V16.01.0.19(5037) or earlier and isolate critical instances from production networks. Within 7 days: Implement network segmentation to restrict administrative access to affected devices; disable remote management features if not operationally required. Within 30 days: Monitor Tenda for patch availability and establish a deployment plan; consider replacement with devices from vendors with active security support.

W30e Firmware CVE-2026-24440

HIGH

Unverified Password Change (CWE-620)

2026-01-26 disclosure@vulncheck.com

Authentication Bypass W30e Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 26, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.

AnalysisAI

Unauthenticated password modification in Tenda W30E V2 firmware through the maintenance interface allows authenticated users to reset account credentials without password verification, potentially enabling privilege escalation or account takeover on affected devices. The vulnerability affects firmware versions up to V16.01.0.19(5037) and currently lacks an available patch.

Technical ContextAI

Affects the maintenance component of W30E Firmware. Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.