CVE-2026-24436

9.2 criticalEPSS 0.5%

Critical (9.2) in tenda w30e firmware. EPSS 0.5% chance of exploitation in the next 30 days.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2026-01-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tenda:w30e_firmware

References

https://www.tendacn.com/product/W30E
https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authentication

Check your stack JSON