Cyber Resilience

CVE-2026-38835

CriticalPublic PoCRCE

Published: 21 April 2026

Published
21 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0215 79.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-38835 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda W30E Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

Tenda W30E V2.0 running firmware V16.01.0.21 contains a command injection vulnerability in the formSetUSBPartitionUmount function, triggered through the usbPartitionName parameter. The flaw is tracked as CVE-2026-38835, carries a CVSS 3.1 score of 9.8, and is classified under CWE-77.

The vulnerability can be exploited by unauthenticated attackers over the network who submit a crafted HTTP request; successful exploitation grants the ability to execute arbitrary commands with full control over the affected device. The current and peak EPSS scores both stand at 0.0102, indicating limited observed exploitation interest to date.

Public references consist of a pair of GitHub reports that document the issue but supply no vendor advisory, patch details, or mitigation guidance.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Unauthenticated remote command injection via unsanitized web parameter on public-facing router enables exploitation of public-facing application (T1190) and network device CLI command execution (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-38834Same product: Tenda W30E
CVE-2026-24429Same product: Tenda W30E
CVE-2026-31255Same vendor: Tenda
CVE-2025-25632Same vendor: Tenda
CVE-2026-24440Same product: Tenda W30E
CVE-2025-57085Same product: Tenda W30E
CVE-2026-24436Same product: Tenda W30E
CVE-2026-24430Same product: Tenda W30E
CVE-2026-24428Same product: Tenda W30E
CVE-2026-1638Same vendor: Tenda

Affected Assets

tenda
w30e firmware
16.01.0.21

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks the command injection by validating/sanitizing the usbPartitionName parameter before it reaches formSetUSBPartitionUmount.

AC-3 Access Enforcement good match
prevent

Enforces access control checks so unauthenticated network requests cannot invoke the vulnerable USB partition function.

SC-7 Boundary Protection partial match
prevent

Restricts network exposure of the router's management interface, reducing the attack surface for unauthenticated crafted requests.

References