CVE-2026-24432

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24432
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered by an authenticated user’s browser, modify administrative passwords and other configuration settings.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.tendacn.com/product/W30E Product
https://www.vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tenda:w30e:-:*:*:*:*:*:*:*
History

17 Jun 2026, 10:23

Type Values Removed Values Added
Summary
  • (es) Las versiones de firmware de Shenzhen Tenda W30E V2 hasta la V16.01.0.19(5037) inclusive carecen de protecciones contra falsificación de petición en sitios cruzados (CSRF) en los puntos finales administrativos, incluyendo aquellos utilizados para cambiar las credenciales de la cuenta de administrador. Como resultado, un atacante puede elaborar peticiones maliciosas que, cuando son activadas por el navegador de un usuario autenticado, modifican las contraseñas administrativas y otras configuraciones.

28 Jan 2026, 20:11

Type Values Removed Values Added
First Time Tenda
Tenda w30e Firmware
Tenda w30e
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CPE cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tenda:w30e:-:*:*:*:*:*:*:*
References () https://www.tendacn.com/product/W30E - () https://www.tendacn.com/product/W30E - Product
References () https://www.vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions - () https://www.vulncheck.com/advisories/tenda-w30e-v2-missing-csrf-protections-for-administrative-actions - Third Party Advisory

26 Jan 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-26 18:16

Updated : 2026-06-17 10:23

NVD link : CVE-2026-24432

Mitre link : CVE-2026-24432

CVE.ORG link : CVE-2026-24432

JSON object : View

Products Affected

tenda

  • w30e
  • w30e_firmware
CWE
CWE-352

Cross-Site Request Forgery (CSRF)