VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 9, 2026· Updated Jun 17, 2026

CVE-2026-30140

CVE-2026-30140

Description

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.

Affected products

3
  • Tenda/W15Ellm-fuzzy2 versions
    V02.03.01.26_cn+ 1 more
    • (no CPE)range: V02.03.01.26_cn
    • (no CPE)
  • Tenda/W15e Firmware
    cpe:2.3:o:tenda:w15e_firmware:02.03.01.26_cn:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.