CVE-2026-24430
Published: 26 January 2026
Summary
CVE-2026-24430 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Tenda W30E Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability exposes plaintext credentials in unauthenticated HTTP responses on the management interface, directly enabling network sniffing or adversary-in-the-middle interception (T1040/T1557) to obtain valid accounts (T1078) via the exposed external remote service (T1133).
NVD Description
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed…
more
to network-based interception.
Deeper analysisAI
CVE-2026-24430 is a vulnerability in the Shenzhen Tenda W30E V2 router firmware, affecting versions up to and including V16.01.0.19(5037). The issue stems from the maintenance interface disclosing sensitive account credentials in cleartext within HTTP responses. As the management interface is accessible over unencrypted HTTP by default, this exposes credentials to potential network-based interception, classified under CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
Network-based attackers can exploit this vulnerability by intercepting HTTP traffic to the management interface, such as through man-in-the-middle techniques on the local network or exposed WAN if misconfigured. No authentication, privileges, or user interaction are required, enabling remote exploitation with low complexity. Successful interception yields plaintext credentials, potentially granting attackers administrative access to the device for further actions like configuration changes or pivoting within the network.
Advisories provide guidance on mitigation; refer to the Tenda product page at https://www.tendacn.com/product/W30E and the VulnCheck advisory at https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials for details on patches, workarounds, or configuration recommendations, such as enabling HTTPS or restricting management interface access.
Details
- CWE(s)