Tenda W30E Firmware vulnerabilities

CVE-2024-32286 [CRITICAL] CWE-125 CVE-2024-32286: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page para Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVirtualSer function.

CVE-2023-49406 [CRITICAL] CVE-2023-49406: Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the fun Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.

CVE-2023-49411 [CRITICAL] CWE-787 CVE-2023-49411: Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMesh Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.

CVE-2023-49410 [CRITICAL] CWE-787 CVE-2023-49410: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the fun Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status.

CVE-2024-32292 [HIGH] CWE-77 CVE-2024-32292: Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCo Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.

CVE-2025-57085 [CRITICAL] CWE-121 CVE-2025-57085: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVE-2024-32293 [HIGH] CWE-121 CVE-2024-32293: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function.

CVE-2023-25231 [CRITICAL] CWE-787 CVE-2023-25231: Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via pa Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.

CVE-2024-32285 [HIGH] CWE-121 CVE-2024-32285: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password paramete Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password parameter in the formaddUserName function.

CVE-2026-24430 [HIGH] CWE-201 CVE-2026-24430: Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive ac Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.

CVE-2022-45509 [HIGH] CWE-787 CVE-2022-45509: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /g Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName.

CVE-2024-52789 [HIGH] CWE-798 CVE-2024-52789: Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/s Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

CVE-2022-45511 [HIGH] CWE-787 CVE-2022-45511: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex.

CVE-2022-45524 [HIGH] CWE-787 CVE-2022-45524: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /g Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave.

CVE-2022-45519 [HIGH] CWE-787 CVE-2022-45519: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter.

CVE-2022-45515 [HIGH] CWE-787 CVE-2022-45515: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /g Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /goform/addressNat.

CVE-2022-45508 [HIGH] CWE-787 CVE-2022-45508: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter a Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName.

CVE-2022-45525 [HIGH] CWE-787 CVE-2022-45525: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at /goform/CertListInfo.

CVE-2022-45505 [HIGH] CWE-787 CVE-2022-45505: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at / Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand.

CVE-2022-45510 [HIGH] CWE-787 CVE-2022-45510: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit_ssid_index paramete Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit_ssid_index parameter at /goform/AdvSetWrlsafeset.