What is the CVSS score of CVE-2026-30140?

CVE-2026-30140 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of W15e Firmware are affected by CVE-2026-30140?

A high-severity access control flaw in Tenda W15E wireless devices (v02.03.01.26_cn) allows unauthorized users to bypass authentication and access sensitive functions.

How to fix or mitigate CVE-2026-30140?

Within 24 hours: Inventory all Tenda W15E devices running affected firmware version and isolate them from critical network segments. Within 7 days: Implement network segmentation and restrict administrative access through firewall rules; monitor device logs for unauthorized access attempts. Within 30 days: Monitor Tenda for patch availability and establish a deployment timeline; evaluate replacement with alternative vendors if patches remain unavailable.

W15e Firmware CVE-2026-30140

HIGH

Improper Access Control (CWE-284)

2026-03-09 cve@mitre.org

Information Disclosure Authentication Bypass W15e Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 19:16 nvd

HIGH 7.5

DescriptionCVE.org

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.

AnalysisAI

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-284 (Improper Access Control). An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.