CVE-2026-24430 affects Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware versions up to V16.01.0.19(5037). The vulnerability involves the disclosure of sensitive account credentials in cleartext within HTTP responses generated by the device's maintenance interface. Since the management interface uses unencrypted HTTP by default, credentials can be intercepted by attackers with network access. This is classified under CWE-201, which concerns insertion of sensitive information into sent data. The vulnerability has a high CVSS 4.0 score of 8.2, reflecting the network attack vector and high impact on confidentiality.

Exposure of sensitive account credentials in cleartext over an unencrypted management interface can lead to unauthorized access to the device. Attackers on the same network segment could intercept these credentials via network traffic capture, potentially compromising device management and network security. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the maintenance interface, using network segmentation, or employing additional network-level encryption or VPNs to protect management traffic. Avoid using the device on untrusted networks where interception risk is higher.