GCVE - cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Tenda (`cebb1c0a-7ddd-5bf6-9fc6-52b2b4f8dd42`)
Product	W30E Firmware (`c9484f9a-db91-574a-acc0-287ad67c8e6c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-24440`	vulnerable	2026-06-08 07:51:17.678124	Tenda W30E V2 Allows Password Changes Without Verifying Current Password Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained. Published: 2026-01-26T17:38:44.054Z Updated: 2026-05-14T02:09:39.530Z Open on db.gcve.eu Reference links https://www.tendacn.com/product/W30E https://www.vulncheck.com/advisories/tenda-w30e-v2-allows-password-change-without-verifying-current-password	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24439`	vulnerable	2026-06-08 07:51:17.677783	Tenda W30E V2 Lacks X-Content-Type-Options Header Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script. Published: 2026-01-26T17:48:37.336Z Updated: 2026-05-14T02:09:38.739Z Open on db.gcve.eu Reference links https://www.tendacn.com/product/W30E https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-x-content-type-options-header	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24437`	vulnerable	2026-06-08 07:51:17.677248	Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives. As a result, browsers may store credential-bearing responses locally, exposing them to subsequent unauthorized access. Published: 2026-01-26T17:40:22.992Z Updated: 2026-05-14T02:09:37.968Z Open on db.gcve.eu Reference links https://www.tendacn.com/product/W30E https://www.vulncheck.com/advisories/tenda-w30e-v2-missing-cache-controls-for-credential-bearing-pages	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24436`	vulnerable	2026-06-08 07:51:17.676846	Tenda W30E V2 Lacks Rate Limiting on Authentication Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials. Published: 2026-01-26T17:40:04.668Z Updated: 2026-05-14T02:09:37.137Z Open on db.gcve.eu Reference links https://www.tendacn.com/product/W30E https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authentication	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24435`	vulnerable	2026-06-08 07:51:17.676017	Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints. The device sets Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true, allowing attacker-controlled origins to issue credentialed cross-origin requests. Published: 2026-01-26T17:49:03.354Z Updated: 2026-05-14T02:09:36.370Z Open on db.gcve.eu Reference links https://www.tendacn.com/product/W30E https://www.vulncheck.com/advisories/tenda-w30e-v2-permissive-cors-allows-cross-origin-data-access	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24433`	vulnerable	2026-06-08 07:51:17.674848	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24432`	vulnerable	2026-06-08 07:51:17.672225	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24431`	vulnerable	2026-06-08 07:51:17.671729	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24430`	vulnerable	2026-06-08 07:51:17.671383	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24429`	vulnerable	2026-06-08 07:51:17.669805	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24428`	vulnerable	2026-06-08 07:51:17.668528	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-57087`	vulnerable	2026-06-08 07:33:15.783180	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-57086`	vulnerable	2026-06-08 07:33:15.782768	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-57085`	vulnerable	2026-06-08 07:33:15.781541	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.