Cyber Resilience

CVE-2026-24431

Tenda W30E Firmware ≤ 16.01.0.19\(5037\)

Public PoC
Published
26 January 2026
Modified
28 January 2026
Patch / advisory
View advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0019 9th percentile
Risk Priority 34 floored blend · peak EPSS

Summary

CVE-2026-24431 is a high-severity Cleartext Storage of Sensitive Information in GUI (CWE-317) vulnerability in Tenda W30E Firmware. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Screen Capture (T1113); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials.

CWE(s)
CWE-317

Related Threats

MITRE ATT&CK Enterprise Techniques

T1113 Screen Capture Collection
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-24437Same product: Tenda W30E
CVE-2024-52789Same product: Tenda W30E
CVE-2026-38835Same product: Tenda W30E
CVE-2026-24435Same product: Tenda W30E
CVE-2026-24436Same product: Tenda W30E
CVE-2023-49999Same product: Tenda W30E
CVE-2023-49402Same product: Tenda W30E
CVE-2023-49411Same product: Tenda W30E
CVE-2026-24429Same product: Tenda W30E
CVE-2024-32291Same product: Tenda W30E

Affected Assets

tenda
w30e firmware
≤ 16.01.0.19\(5037\)

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-6 Authentication Feedback partial match

Obscures authentication feedback in the GUI, directly stopping cleartext display of sensitive credentials.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Protecting data-at-rest confidentiality directly prevents cleartext GUI storage of sensitive data.

PR.DS-10 partial match
prevents

Protecting data-in-use confidentiality mitigates in-memory GUI exposure but does not address persisted storage.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.11 Data masking full match
degrades

Data masking directly prevents cleartext display of sensitive GUI data.

A.8.24 Use of cryptography partial match
prevents

Cryptography can protect data at rest/display, but does not mandate GUI-level masking.

A.8.26 Application security requirements partial match
prevents

Application security requirements may include masking rules, yet the control is wider than this CWE.

A.8.28 Secure coding partial match
prevents

Secure coding practices can prevent the weakness but do not address the control's broader scope.

A.8.3 Information access restriction partial match
degrades

Access restriction limits who sees the GUI, but does not address cleartext storage itself.

References