High severity · published Jan 26, 2026
CVE-2026-24440
Tenda W30E V2 Allows Password Changes Without Verifying Current Password
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WV
W30E V2 · Shenzhen Tenda Technology Co., Ltd.
through 16.01.0.19(5037) · source: vendor
WF
W30e Firmware · Tenda
through 16.01.0.19\(5037\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24440
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24440
Product
https://www.tendacn.com/product/W30E
Third Party Advisory
https://www.vulncheck.com/advisories/tenda-w30e-v2-allows-password-change-without-verifying-current-password
More from W30E V2
9.8
CVE-2026-24436
Tenda W30E V2 Lacks Rate Limiting on Authentication
9.8
CVE-2026-24429
Tenda W30E V2 Hardcoded Default Password for Built-in Account
8.8
CVE-2026-24428
Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
7.5
CVE-2026-24430
Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
6.5
CVE-2026-24435
Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access