Tenda w30e Firmware any version

Tenda W30E V2 Lacks Rate Limiting on Authentication

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Tenda W30E V2 Hardcoded Default Password for Built-in Account

Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change

Tenda W30E V2 Allows Password Changes Without Verifying Current Password

Tenda W30E V2 HTTP Responses Expose Plaintext Credentials

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access

Tenda W30E V2 Web UI Reveals Passwords in Cleartext

Tenda W30E V2 Lacks X-Content-Type-Options Header

Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages

Tenda W30E V2 Stored XSS via Username Field

Tenda W30E V2 Missing CSRF Protections for Administrative Actions