CVE-2026-24437 affects Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware versions up to V16.01.0.19(5037). The vulnerability arises because the device serves sensitive administrative content without proper cache-control directives, causing browsers to cache credential-bearing responses. This can lead to unauthorized access if an attacker gains access to the local browser cache. The CVSS 4.0 vector indicates a local attacker with low privileges can exploit this without user interaction, but the impact is limited to confidentiality due to exposure of cached sensitive data. There is no indication of remote exploitation or integrity/availability impact.

The vulnerability exposes sensitive administrative credentials stored in the browser cache, which could be accessed by unauthorized users with local access to the affected machine. This may lead to unauthorized administrative access to the device if cached credentials are reused. The impact is limited to confidentiality compromise of cached data. There are no known exploits in the wild, and no evidence of remote exploitation capability.

No official patch or remediation is currently available for this vulnerability. Users should check Shenzhen Tenda Technology Co., Ltd. advisories for updates. As a temporary mitigation, users should clear their browser cache regularly and avoid accessing the administrative interface from shared or untrusted devices. Network administrators should restrict local access to trusted users only. Monitor vendor communications for any forthcoming fixes.