CVE-2026-24435 is a CWE-942 vulnerability affecting Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware versions up to V16.01.0.19(5037). The issue arises from an insecure CORS policy on authenticated administrative endpoints where Access-Control-Allow-Origin is set to '*' combined with Access-Control-Allow-Credentials: true. This configuration allows any attacker-controlled origin to perform credentialed cross-origin requests, potentially leading to unauthorized actions on the device's administrative interface. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P).

An attacker can exploit the permissive CORS policy to perform credentialed cross-origin requests from malicious websites, potentially accessing or manipulating administrative functions on the affected device. This could lead to unauthorized control or information disclosure related to the router's administration. The CVSS 4.0 score of 7.1 reflects a high impact due to the combination of network attack vector, low attack complexity, no privileges required, and high impact on confidentiality via cross-origin credential leakage.

No official patch or remediation is currently available from Shenzhen Tenda Technology Co., Ltd. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid exposing the device's administrative interface to untrusted networks or web origins and consider restricting access to trusted networks only. Monitoring vendor communications for updates is recommended.