CVE-2026-30140

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30140
An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure Broken Link
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:w15e_firmware:02.03.01.26_cn:*:*:*:*:*:*:*
cpe:2.3:h:tenda:w15e:-:*:*:*:*:*:*:*
History

13 Mar 2026, 19:40

Type Values Removed Values Added
CPE cpe:2.3:o:tenda:w15e_firmware:02.03.01.26_cn:*:*:*:*:*:*:*
cpe:2.3:h:tenda:w15e:-:*:*:*:*:*:*:*
First Time Tenda
Tenda w15e Firmware
Tenda w15e
References () https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure - () https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure - Broken Link

11 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-284

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de control de acceso incorrecto existe en Tenda W15E V02.03.01.26_cn. Un atacante no autenticado puede acceder al endpoint /cgi-bin/DownloadCfg/RouterCfm.jpg para descargar el archivo de configuración que contiene credenciales de administrador en texto plano, lo que lleva a la revelación de información sensible y a un posible acceso administrativo remoto.

09 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-09 19:16

Updated : 2026-03-13 19:40

NVD link : CVE-2026-30140

Mitre link : CVE-2026-30140

CVE.ORG link : CVE-2026-30140

JSON object : View

Products Affected

tenda

  • w15e
  • w15e_firmware
CWE
CWE-284

Improper Access Control