CVE-2026-24440

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-620

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-244415.9Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-CVE-2026-244438.8EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the We CVE-2026-244449.8SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web managemen CVE-2026-244459.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-244474.8If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When CVE-2026-244489.3Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.CVE-2026-244495.1For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.CVE-2026-24456.1The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering CVE-2026-244509.8An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted mal CVE-2026-244517.5Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that CVE-2026-244528.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote c CVE-2026-244557.5The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encod