Critical severity · published Jan 26, 2026
CVE-2026-24436
Tenda W30E V2 Lacks Rate Limiting on Authentication
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WV
W30E V2 · Shenzhen Tenda Technology Co., Ltd.
through 16.01.0.19(5037) · source: vendor
WF
W30e Firmware · Tenda
through 16.01.0.19\(5037\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24436
Product
https://www.tendacn.com/product/W30E
Third Party Advisory
https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authentication
More from W30E V2
9.8
CVE-2026-24429
Tenda W30E V2 Hardcoded Default Password for Built-in Account
8.8
CVE-2026-24428
Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
8.8
CVE-2026-24440
Tenda W30E V2 Allows Password Changes Without Verifying Current Password
7.5
CVE-2026-24430
Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
6.5
CVE-2026-24435
Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access