by Kastro
Paper/Archive/CVE-2026-24429

CVE-2026-24429

Shenzhen Tenda Technology Co., Ltd. W30E V2 — Tenda W30E V2 Hardcoded Default Password for Built-in Account

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.8.368 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated access to the management interface.

Affected

ProductAffectedFixed inSource
W30E V2≤ 16.01.0.19(5037)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftendacn.com/product/W30Ewriteupvulncheck.com/advisories/tenda-w30e-v2-hardcoded-default-password-for-built-in-account