Critical severity9.8NVD Advisory· Published Jan 26, 2026· Updated Jun 17, 2026

CVE-2026-24436

Description

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tenda/W30E V2llm-fuzzy2 versions
<=V16.01.0.19(5037)+ 1 more
- (no CPE)range: <=V16.01.0.19(5037)
- (no CPE)range: 0
Tenda/W30e Firmware
cpe:2.3:o:tenda:w30e_firmware:*:*:*:*:*:*:*:*
Range: <=16.01.0.19\(5037\)

Patches

Vulnerability mechanics

References

www.vulncheck.com/advisories/tenda-w30e-v2-lacks-rate-limiting-on-authenticationnvdThird Party Advisory
www.tendacn.com/product/W30EnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000