CVE-2026-24439

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - disclosure@vulncheck.com

Published

2026-01-26

Last modified

2026-05-14

Weaknesses

CWE-116

Affected products

• W30e Firmware (Tenda)

References

• https://www.tendacn.com/product/W30E
• https://www.vulncheck.com/advisories/tenda-w30e-v2-lacks-x-content-type-options-header