CVE-2026-24433 is a stored cross-site scripting vulnerability (CWE-79) in Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware up to version V16.01.0.19(5037). The vulnerability occurs due to improper neutralization of input during web page generation in the user creation functionality. An attacker can inject malicious script content that is stored persistently and executed when an administrative user views the affected management interface pages. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the administrative interface when an admin accesses the affected pages. This could lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. However, the impact is limited by the need for administrative user interaction and the low confidentiality, integrity, and availability impacts as per the CVSS vector.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should limit access to the management interface to trusted users and networks and exercise caution when interacting with user-generated content in the management interface.