CVE-2026-24436: Critical Missing Rate Limit in Tenda W30E V2

CVE-2026-24436 is a critical (CVSS 9.8) flaw in Tenda W30E V2 routers. Firmware up to and including V16.01.0.19(5037) has no rate limiting or account lockout on authentication endpoints, so password guessing is unrestricted. No fixed firmware is confirmed, so restrict management access and use strong credentials.

What's affected

The affected product is the Shenzhen Tenda W30E V2 with firmware V16.01.0.19(5037) and earlier. The advisory says authentication endpoints do not enforce rate limiting or account lockout, which allows unrestricted brute force attempts against administrative credentials.

The sources I could read, VulnCheck's advisory and Tenda's product page, do not name a fixed firmware version. Check Tenda's support downloads for the W30E V2.

How to check if you're exposed

Check the firmware version in the admin page. Then check where the management interface is reachable from. A login page that anyone on the internet can reach, with no lockout, is the situation to avoid.

If you have router logs, look for long runs of failed logins from a single source.

What to do now

1. Check Tenda's support page for newer W30E V2 firmware.
2. Disable remote management on the WAN side.
3. Allow management only from a trusted internal network or a VPN.
4. Use a long, unique administrator password, since the device will not slow down guessing.
5. Replace the router if no fix is available and it guards anything sensitive.

Why it matters

The weakness is CWE-307, improper restriction of excessive authentication attempts. Without a delay or a lockout, an attacker can try as many passwords as the network allows, so the strength of the password becomes the only defense.

This pairs badly with CVE-2026-24429 on the same firmware, which describes a default password on a built-in account. Neither is in CISA's Known Exploited Vulnerabilities catalog.

Quick check

Sources

• VulnCheck advisory
• Tenda W30E product page

Last reviewed: 19 October 2026.