CVE-2026-24430: fallo de gravedad alta en Shenzhen Tenda Technology Co., Ltd. W30E V2
Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.3%
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Shenzhen Tenda Technology Co., Ltd. · W30E V2CVEs relacionadas — Shenzhen Tenda Technology Co., Ltd. W30E V2
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-24436CRITICALTenda W30E V2 Lacks Rate Limiting on AuthenticationEPSS 0.5%CVE-2026-24429CRITICALTenda W30E V2 Hardcoded Default Password for Built-in AccountEPSS 0.4%CVE-2026-24428HIGHTenda W30E V2 Incorrect Authorization Allows Administrator Password ChangeEPSS 0.3%CVE-2026-24440HIGHTenda W30E V2 Allows Password Changes Without Verifying Current PasswordEPSS 0.3%CVE-2026-24435HIGHTenda W30E V2 Permissive CORS Allows Cross-origin Data AccessEPSS 0.3%CVE-2026-24431HIGHTenda W30E V2 Web UI Reveals Passwords in CleartextEPSS 0.2%