CVE-2026-38834: Tenda w30e Firmware

High severity, CVSS 7.3. EPSS: 1.6% chance of exploitation in the next 30 days.

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

• Tenda w30e Firmware: version 16.01.0.21 only

Published 2026-04-21. Last modified 2026-06-17.