What is the CVSS score of CVE-2026-38835?

CVE-2026-38835 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Tenda W30E are affected by CVE-2026-38835?

Tenda W30E V2.0 routers running firmware V16.01.0.21 are vulnerable to unauthenticated remote command injection that allows attackers to execute arbitrary commands with root privileges through a USB…

How to fix or mitigate CVE-2026-38835?

Within 24 hours: identify all Tenda W30E V2.0 devices on your network and document firmware versions. Within 7 days: immediately isolate affected units (V16.01.0.21) from internet access or restrict WAN connectivity to this device class; contact Tenda for patch availability and timeline. Within 30 days: upgrade to patched firmware when released by Tenda, or implement network segmentation to limit lateral movement if patched firmware is unavailable.

Tenda W30E CVE-2026-38835

EUVD-2026-24163 CRITICAL

Command Injection (CWE-77)

2026-04-21 cve@mitre.org

GHSA-656r-ggpg-wmqm

Tenda Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 16:22 vuln.today

CVSS changed

Apr 22, 2026 - 16:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 21, 2026 - 17:22 euvd

EUVD-2026-24163

Analysis Generated

Apr 21, 2026 - 17:22 vuln.today

CVE Published

Apr 21, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

AnalysisAI

Command injection in Tenda W30E V2.0 firmware V16.01.0.21 allows remote unauthenticated attackers to execute arbitrary operating system commands as root through the formSetUSBPartitionUmount function by manipulating the usbPartitionName parameter. The vulnerability achieves maximum CVSS severity (9.8) due to network accessibility without authentication, though EPSS exploitation probability remains low (0.17%, 38th percentile), suggesting limited attacker interest at time of analysis. No active exploitation confirmed by CISA KEV, and public exploit code status is unverified from researcher disclosure.

Technical ContextAI

This vulnerability affects the Tenda W30E wireless router's USB partition management functionality, specifically in firmware version V16.01.0.21 for hardware V2.0. The root cause is CWE-77 (Command Injection), where the formSetUSBPartitionUmount function fails to properly sanitize the usbPartitionName parameter before passing it to underlying system calls. When processing USB unmount requests through the web management interface, unsanitized user input flows directly into shell command execution contexts, allowing injection of arbitrary commands with the privileges of the router's web server process (typically root on embedded devices). This class of vulnerability is common in SOHO router firmware where rapid development cycles and limited security review create gaps in input validation for system administration functions.

RemediationAI

No vendor-released patch for Tenda W30E firmware V16.01.0.21 identified at time of analysis-check Tenda's official support site (tendacn.com or tendaus.com depending on region) for firmware updates newer than V16.01.0.21. Until patching: (1) Ensure web management interface is disabled on WAN interface or restrict access to trusted IP ranges only via firewall rules-this prevents remote exploitation but breaks remote management capability. (2) Place affected routers behind additional firewall layers and limit management access to isolated admin VLANs-adds network segmentation overhead. (3) Disable USB storage features entirely if not operationally required, removing the vulnerable code path-eliminates USB functionality. (4) For high-security environments, consider replacing device with enterprise-grade equipment from vendors with established vulnerability disclosure programs. Monitor Tenda's support channels and the original researcher disclosure at https://github.com/jsjbcyber/repo/blob/main/rep_2.md for updates on patch availability.