CVE-2026-24436

CWE-3073 documents3 sources
Severity
9.2CRITICAL
EPSS
0.0%
top 87.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Shenzhen Tenda Technology Co., Ltd. W30e V2Tenda W30e Firmware
Timeline
PublishedJan 26

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDtenda/w30e_firmware16.01.0.19\(5037\)

🔴Vulnerability Details

2
GHSA
GHSA-j73p-m2g8-wpgm: Shenzhen Tenda W30E V2 firmware versions up to and including V16↗2026-01-26
▶
CVEList
Tenda W30E V2 Lacks Rate Limiting on Authentication↗2026-01-26
▶
CVE-2026-24436 (CRITICAL CVSS 9.2) | Shenzhen Tenda W30E V2 firmware ver | cvebase.io