Tenda W30E Firmware vulnerabilities

CVE-2024-32291 [HIGH] CWE-121 CVE-2024-32291: Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function.

CVE-2024-52789 [HIGH] CWE-798 CVE-2024-52789: Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/s Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

CVE-2022-45523 [HIGH] CWE-787 CVE-2022-45523: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/L7Im.

CVE-2022-45512 [HIGH] CWE-787 CVE-2022-45512: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter.

CVE-2022-45521 [HIGH] CWE-787 CVE-2022-45521: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter.

CVE-2022-45514 [HIGH] CWE-787 CVE-2022-45514: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/webExcptypemanFilter.

CVE-2022-45520 [HIGH] CWE-787 CVE-2022-45520: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting.

CVE-2022-45522 [HIGH] CWE-787 CVE-2022-45522: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter.

CVE-2022-45518 [HIGH] CWE-787 CVE-2022-45518: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind.

CVE-2022-45516 [HIGH] CWE-787 CVE-2022-45516: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/NatStaticSetting.

CVE-2022-45517 [HIGH] CWE-787 CVE-2022-45517: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/VirtualSer.

CVE-2022-45513 [HIGH] CWE-787 CVE-2022-45513: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /gofo Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter.

CVE-2025-57087 [HIGH] CWE-121 CVE-2025-57087: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode paramete Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVE-2026-24431 [MEDIUM] CWE-317 CVE-2026-24431: Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user a Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials.

CVE-2025-57086 [HIGH] CWE-121 CVE-2025-57086: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVE-2026-24435 [MEDIUM] CWE-942 CVE-2026-24435: Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints. The device sets Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true, allowing attacker-controlled origins to issue credential

CVE-2024-32290 [MEDIUM] CWE-121 CVE-2024-32290: Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function.

CVE-2026-24439 [MEDIUM] CWE-116 CVE-2026-24439: Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script.

CVE-2024-32288 [MEDIUM] CWE-121 CVE-2024-32288: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page para Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter function.

CVE-2024-32287 [MEDIUM] CWE-121 CVE-2024-32287: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in the fromqossetting function.