high7.5

CVE-2026-30140

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn.

Impact

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.

Affected products

Vendor	Product	Affected versions
Tenda	W15e Firmware	Version 02.03.01.26_cn

Weakness classification

CWE-284

References

NVD record
CVE.org record
https://github.com/jhx-ui/CVE-Reports/blob/main/README.md#vulnerability-report-tenda-router-sensitive-information-disclosure