CVE-2026-24430
Published: 26 January 2026
Summary
CVE-2026-24430 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Tenda W30E Firmware. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-24430 is a vulnerability in the Shenzhen Tenda W30E V2 router firmware, affecting versions up to and including V16.01.0.19(5037). The issue stems from the maintenance interface disclosing sensitive account credentials in cleartext within HTTP responses. As the management interface is accessible over unencrypted HTTP by default, this exposes credentials to potential network-based interception, classified under CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
Network-based attackers can exploit this vulnerability by intercepting HTTP traffic to the management interface, such as through man-in-the-middle techniques on the local network or exposed WAN if misconfigured. No authentication, privileges, or user interaction are required, enabling remote exploitation with low complexity. Successful interception yields plaintext credentials, potentially granting attackers administrative access to the device for further actions like configuration changes or pivoting within the network.
Advisories provide guidance on mitigation; refer to the Tenda product page at https://www.tendacn.com/product/W30E and the VulnCheck advisory at https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials for details on patches, workarounds, or configuration recommendations, such as enabling HTTPS or restricting management interface access.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4679
Vulnerability details
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed…
more
to network-based interception.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability exposes plaintext credentials in unauthenticated HTTP responses on the management interface, directly enabling network sniffing or adversary-in-the-middle interception (T1040/T1557) to obtain valid accounts (T1078) via the exposed external remote service (T1133).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-8 mandates confidentiality and integrity protection for transmissions, directly preventing network interception of cleartext credentials in unencrypted HTTP responses from the management interface.
CM-6 enforces secure configuration settings, such as requiring HTTPS for the maintenance interface to avoid cleartext credential disclosure over HTTP.
SC-7 boundary protection controls access to the management interface at network boundaries, minimizing exposure to network-based interception attacks.