W30e firmware

This hub aggregates every CVE we track for W30e firmware, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting W30e firmware.

• CVE-2026-38835Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers ...9.8Apr 21, 2026
• CVE-2026-38834Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrar...7.3Apr 21, 2026
• CVE-2026-24435Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access6.5Jan 26, 2026
• CVE-2026-24439Tenda W30E V2 Lacks X-Content-Type-Options Header6.5Jan 26, 2026
• CVE-2026-24432Tenda W30E V2 Missing CSRF Protections for Administrative Actions4.3Jan 26, 2026
• CVE-2026-24433Tenda W30E V2 Stored XSS via Username Field5.4Jan 26, 2026
• CVE-2026-24431Tenda W30E V2 Web UI Reveals Passwords in Cleartext6.5Jan 26, 2026
• CVE-2026-24437Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages5.5Jan 26, 2026
• CVE-2026-24436Tenda W30E V2 Lacks Rate Limiting on Authentication9.8Jan 26, 2026
• CVE-2026-24428Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change8.8Jan 26, 2026
• CVE-2026-24430Tenda W30E V2 HTTP Responses Expose Plaintext Credentials7.5Jan 26, 2026
• CVE-2026-24429Tenda W30E V2 Hardcoded Default Password for Built-in Account9.8Jan 26, 2026
• CVE-2026-24440Tenda W30E V2 Allows Password Changes Without Verifying Current Password8.8Jan 26, 2026
• CVE-2025-57087Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Se...7.5Sep 9, 2025
• CVE-2025-57085Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a...9.8Sep 9, 2025