High severity · published Jan 26, 2026
CVE-2026-24430
Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WV
W30E V2 · Shenzhen Tenda Technology Co., Ltd.
through 16.01.0.19(5037) · source: vendor
WF
W30e Firmware · Tenda
through 16.01.0.19\(5037\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24430
Product
https://www.tendacn.com/product/W30E
Third Party Advisory
https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials
More from W30E V2
9.8
CVE-2026-24436
Tenda W30E V2 Lacks Rate Limiting on Authentication
9.8
CVE-2026-24429
Tenda W30E V2 Hardcoded Default Password for Built-in Account
8.8
CVE-2026-24428
Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
8.8
CVE-2026-24440
Tenda W30E V2 Allows Password Changes Without Verifying Current Password
6.5
CVE-2026-24435
Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access