← Back

CVE-2026-24430

nvd nist
Published: Jan 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.2
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.

Affected (1)

Products: Tenda: W30e Firmware
Tenda
1 product
W30e Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
W30e Firmware
Up to 16.01.0.19\(5037\)
Running on/withPlatform Versions
Tenda
W30e
Version 2.0

Related CWEs

CWE-201
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (2)

Source: disclosure@vulncheck.com
Product
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.