CVE-2026-30140

published 2026-03-09

CVE-2026-30140: An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
tenda	w15e_firmware	—	—

CWE-284