Security Advisory

CVE-2026-24428

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-01-26 17:39:45

Last updated 2026-05-14 02:09:30

Assigner VulnCheck

State PUBLISHED

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.

← Browse all CVEs View on cve.org ↗