Unrated severityNVD Advisory· Published Jan 26, 2026· Updated Mar 5, 2026
Tenda W30E V2 Stored XSS via Username Field
CVE-2026-24433
Description
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users access the affected management pages.
Affected products
2- Shenzhen Tenda Technology Co., Ltd./W30E V2v5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.vulncheck.com/advisories/tenda-w30e-v2-stored-xss-via-user-name-fieldmitrethird-party-advisory
- www.tendacn.com/product/W30Emitreproduct
News mentions
0No linked articles in our index yet.