CVE-2026-24433
📋 TL;DR
This stored cross-site scripting vulnerability in Tenda W30E V2 routers allows attackers to inject malicious scripts into user creation fields. When administrative users view affected management pages, the scripts execute in their browser context, potentially compromising router administration. All users running vulnerable firmware versions are affected.
💻 Affected Systems
- Shenzhen Tenda W30E V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full administrative control of router, modifies network settings, intercepts traffic, or installs persistent malware on the device.
Likely Case
Attacker steals administrative credentials, modifies DNS settings to redirect users to malicious sites, or performs session hijacking.
If Mitigated
Script execution is contained within admin interface with limited impact due to router's isolated nature and lack of sensitive data storage.
🎯 Exploit Status
Exploitation requires ability to create or modify user accounts. Public proof-of-concept demonstrates injection via user name field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for W30E V2. 3. Access router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router admin interface
Restrict Admin Access
allLimit admin interface access to trusted IP addresses only
🧯 If You Can't Patch
- Isolate router management interface on separate VLAN
- Implement strict input validation at network perimeter
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than V16.01.0.19(5037) and test user creation with script payloads📡 Detection & Monitoring
Log Indicators:
- Unusual user creation/modification events
- Admin interface access from unexpected IPs
- HTTP requests containing script tags in user-related parameters
Network Indicators:
- Multiple failed login attempts to admin interface
- Unusual outbound connections from router after admin access
SIEM Query:
source="router.log" AND (event="user_create" OR event="user_modify") AND (message="*<script*" OR message="*javascript:*")