Vulnerability · Published Jan 26, 2026 · Assigned by VulnCheck

CVE-2026-24428Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change

High 8.7

In plain English

A high-severity incorrect authorization in W30E V2 from Shenzhen Tenda Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.

Affected products (as reported)

Vendor	Product	Versions
Shenzhen Tenda Technology Co., Ltd.	W30E V2	0 – through 16.01.0.19(5037)

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.tendacn.com/product/W30E product
https://www.vulncheck.com/advisories/tenda-w30e-v2-incorrect-authorization-allows-administrator-password-change third-party-advisory