MeldSecurity
Press Enter to search
CVE Database & Search →
Sign In Get Started

CVE-2026-24428

🔴 HIGH

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the ad...

Published
Jan 26, 2026
Last Modified
Jan 29, 2026
Views
6
Bookmarks
0

Description

Request Expert Review

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.

Affected Products (1)

tenda - w30e_firmware

Version: *

CVSS Scores

CVSS 3.1 8.8
8.8
HIGH
CVSS 2.0 8.8

References

www.tendacn.com www.vulncheck.com

Additional Information

Source
disclosure@vulncheck.com
State
Analyzed

Related CVEs

CVE-2026-2135

MEDIUM

A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Perfo...

Score: 6.3

CVE-2026-2134

MEDIUM

A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/...

Score: 4.7

CVE-2026-2133

HIGH

A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCateg...

Score: 7.3

CVE-2026-2132

HIGH

A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/...

Score: 7.3

CVE-2026-2131

MEDIUM

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the...

Score: 6.3

CVE-2026-2130

MEDIUM

A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search...

Score: 6.3

Share CVE-2026-24428

Share on Social Media

Copy Link

Embed Code

Request Expert Analysis

Request a professional security analysis for CVE-2026-24428 from our verified experts.

Credits System

Use your credits to get expert analysis from verified security professionals. Purchase more credits anytime!

Add 3 credits for accelerated delivery

Base Cost: 8 credits
Priority Upgrade: + credits
SLA Acceleration: +3 credits
Total Cost:
Your Balance:

Insufficient Credits

You need more credits to submit this request.

Buy Credits

Report Analysis