CVE-2026-24432 | BDVDB-2026-312482 Detail

Description#

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered by an authenticated user’s browser, modify administrative passwords and other configuration settings.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-01-26Record published in the CVE List.
2. Version 22026-05-14Most recent update recorded in the CVE List.