CVE-2026-24432 is a CSRF vulnerability affecting Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware versions up to V16.01.0.19(5037). The firmware lacks CSRF protections on administrative interfaces, including those that handle administrator credential changes. This allows attackers to induce authenticated users to unknowingly submit malicious requests that alter administrative passwords and other critical configuration settings. The vulnerability is network exploitable without privileges and requires user interaction. The CVSS 4.0 vector indicates no confidentiality, integrity, or availability impact beyond the configuration changes. No patch or vendor advisory is currently available.

An attacker can leverage this vulnerability to change administrator passwords and modify router configurations by tricking an authenticated user into triggering crafted requests. This could lead to unauthorized administrative control over the affected device. However, exploitation requires the victim to be authenticated and interact with malicious content. There is no evidence of confidentiality or availability impact beyond configuration changes. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid interacting with untrusted websites while authenticated to the device's administrative interface. Network-level protections such as restricting administrative access to trusted networks may reduce exposure.