Cyber Posture

CVE-2026-24430

HighPublic PoC

Published: 26 January 2026

Published
26 January 2026
Modified
28 January 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0005 14.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24430 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Tenda W30E Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Network Sniffing (T1040) and 3 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-201

Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams.

MITRE ATT&CK Enterprise TechniquesAI

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Why these techniques?

Vulnerability exposes plaintext credentials in unauthenticated HTTP responses on the management interface, directly enabling network sniffing or adversary-in-the-middle interception (T1040/T1557) to obtain valid accounts (T1078) via the exposed external remote service (T1133).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed…

more

to network-based interception.

Deeper analysisAI

CVE-2026-24430 is a vulnerability in the Shenzhen Tenda W30E V2 router firmware, affecting versions up to and including V16.01.0.19(5037). The issue stems from the maintenance interface disclosing sensitive account credentials in cleartext within HTTP responses. As the management interface is accessible over unencrypted HTTP by default, this exposes credentials to potential network-based interception, classified under CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.

Network-based attackers can exploit this vulnerability by intercepting HTTP traffic to the management interface, such as through man-in-the-middle techniques on the local network or exposed WAN if misconfigured. No authentication, privileges, or user interaction are required, enabling remote exploitation with low complexity. Successful interception yields plaintext credentials, potentially granting attackers administrative access to the device for further actions like configuration changes or pivoting within the network.

Advisories provide guidance on mitigation; refer to the Tenda product page at https://www.tendacn.com/product/W30E and the VulnCheck advisory at https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials for details on patches, workarounds, or configuration recommendations, such as enabling HTTPS or restricting management interface access.

Details

CWE(s)

Affected Products

tenda
w30e firmware
≤ 16.01.0.19\(5037\)

CVEs Like This One

CVE-2026-38835Same product: Tenda W30E
CVE-2025-57085Same product: Tenda W30E
CVE-2026-24429Same product: Tenda W30E
CVE-2026-38834Same product: Tenda W30E
CVE-2026-24436Same product: Tenda W30E
CVE-2026-24440Same product: Tenda W30E
CVE-2026-24428Same product: Tenda W30E
CVE-2026-1610Same vendor: Tenda
CVE-2025-1898Same vendor: Tenda
CVE-2025-15007Same vendor: Tenda

References