CVE-2026-24431 affects Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware up to version V16.01.0.19(5037). The vulnerability involves cleartext storage and display of user account passwords in the device's administrative web interface. Any user with access to these management pages can view the passwords directly, posing a significant risk of credential compromise. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1, indicating it can be exploited remotely over the network without user interaction but requires low privileges to access the management interface. No official patch or fix has been documented.

Exposure of plaintext user account passwords in the administrative interface can lead to unauthorized access if an attacker gains access to the management pages. This compromises the confidentiality of credentials and may allow further unauthorized configuration changes or network compromise. The vulnerability requires at least low privileges (authenticated user) to exploit but does not require user interaction or physical access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative web interface to trusted users only, ideally via network segmentation or VPN. Monitor for unauthorized access attempts and consider changing credentials if compromise is suspected.