CVE-2026-24428 is an authorization bypass vulnerability in Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware versions up to V16.01.0.19(5037). The issue lies in the user management API, where a low-privileged authenticated user can send specially crafted requests directly to backend endpoints to change the administrator password, circumventing the role-based restrictions enforced by the web interface. This allows escalation to full administrative control over the device. The vulnerability is classified under CWE-863 (Incorrect Authorization) and has a CVSS 4.0 base score of 8.7, indicating high severity. The vulnerability is not related to cloud services, and no vendor advisory or patch information is currently provided.

An attacker with low-privileged authenticated access to the device can exploit this vulnerability to gain full administrative privileges by changing the administrator password. This compromises the device's security, potentially allowing the attacker to fully control the router, modify configurations, and disrupt network operations. No known exploits in the wild have been reported, but the high CVSS score reflects the significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interfaces to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks. Follow up with Shenzhen Tenda Technology Co., Ltd. for updates on patches or official mitigations.