CVE-2026-24439

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-244408.8Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance CVE-2026-244415.9Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-CVE-2026-244438.8EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the We CVE-2026-244449.8SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web managemen CVE-2026-244459.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-244474.8If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When CVE-2026-244489.3Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.CVE-2026-244495.1For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.CVE-2026-24456.1The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering CVE-2026-244509.8An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted mal CVE-2026-244517.5Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that CVE-2026-244528.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote c