Default Password Vulnerability in Shenzhen Tenda W30E V2 Firmware
CVE-2026-24429

9.3CRITICAL

Key Information:

Vendor

Shenzhen Tenda Technology Co., Ltd.

Status
W30e V2
Vendor
CVE Published:
26 January 2026

What is CVE-2026-24429?

The Shenzhen Tenda W30E V2 firmware contains a critical issue where it ships with a hardcoded default password for a built-in authentication account. This password does not require modification during the device's initial setup. Consequently, an attacker can exploit this vulnerability to gain unauthorized access to the management interface, potentially compromising the device's security and allowing for further attacks.

Affected Version(s)

W30E V2 0 <= 16.01.0.19(5037)

References

https://www.tendacn.com/product/W30E
product
https://www.vulncheck.com/advisories/tenda-w30e-v2-hardco...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.