CVE-2026-24429 is a critical (CVSS 9.8) flaw in Tenda W30E V2 routers. Firmware up to and including V16.01.0.19(5037) ships a predefined default password for a built-in account that does not have to be changed. No fixed firmware is confirmed in the sources, so check Tenda's support page and restrict management access.
What's affected
The affected product is the Shenzhen Tenda W30E V2 with firmware V16.01.0.19(5037) and earlier. The advisory describes a built-in authentication account with a predefined default password that setup does not force you to change.
The sources I could read, VulnCheck's advisory and Tenda's product page, do not name a fixed firmware version. I could not confirm one, so check Tenda's support downloads for the W30E V2 before you assume you are patched.
How to check if you're exposed
Look at the firmware version in the router's admin page and compare it with V16.01.0.19(5037). Then check whether the management interface can be reached from the internet side or from guest networks.
For your own devices, also ask whether anyone ever changed the credentials on the built-in account. If setup did not force a change, you cannot assume it happened.
What to do now
- Check Tenda's support page for newer W30E V2 firmware and apply it if it exists.
- Change every default or built-in credential you can reach, and use a unique strong password.
- Turn off remote management on the WAN side.
- Keep the admin interface on a trusted management network only.
- If no fix appears and the device protects anything important, plan a replacement.
Why it matters
The weakness is CWE-1393, use of default password. Shipping the same credential on every device means the password is effectively public once someone knows it, and routers sit at the edge of the network, so the stakes are high. The record rates confidentiality, integrity and availability impact as high.
This CVE comes with a companion, CVE-2026-24436, which removes rate limiting on logins. Together they leave little in the way of a defense. Neither is in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a patched firmware?
I could not confirm one from the sources. Check Tenda's support downloads for the W30E V2.
What is the most important short term step?
Change the default credentials and make sure the management interface is not reachable from the internet.
Sources
Last reviewed: 19 October 2026.
