CVE-2026-24428: falha de alta gravidade em Shenzhen Tenda Technology Co., Ltd. W30E V2
Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.3%
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Shenzhen Tenda Technology Co., Ltd. · W30E V2CVEs relacionadas — Shenzhen Tenda Technology Co., Ltd. W30E V2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-24436CRITICALTenda W30E V2 Lacks Rate Limiting on AuthenticationEPSS 0.5%CVE-2026-24429CRITICALTenda W30E V2 Hardcoded Default Password for Built-in AccountEPSS 0.4%CVE-2026-24440HIGHTenda W30E V2 Allows Password Changes Without Verifying Current PasswordEPSS 0.3%CVE-2026-24430HIGHTenda W30E V2 HTTP Responses Expose Plaintext CredentialsEPSS 0.3%CVE-2026-24435HIGHTenda W30E V2 Permissive CORS Allows Cross-origin Data AccessEPSS 0.3%CVE-2026-24431HIGHTenda W30E V2 Web UI Reveals Passwords in CleartextEPSS 0.2%