CVE-2026-24440 is a vulnerability in Shenzhen Tenda Technology Co., Ltd.'s W30E V2 router firmware (up to V16.01.0.19(5037)) where the maintenance interface allows password changes without requiring verification of the existing password. This lack of verification (CWE-620) permits unauthorized users who can access the maintenance endpoint to change account passwords, potentially leading to unauthorized control of the device. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker who gains access to the maintenance interface of the affected Tenda W30E V2 device can change account passwords without needing to know the current password. This could lead to unauthorized administrative access and control over the device. The vulnerability does not require user interaction and can be exploited remotely over the network if the attacker can reach the maintenance endpoint. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the maintenance interface to trusted networks and users only. Monitor for any unusual access attempts to the device. Avoid exposing the maintenance interface to untrusted networks. Follow vendor updates for any forthcoming patches or official mitigations.