CVE-2026-38835: Tenda w30e Firmware

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

• Tenda w30e Firmware: version 16.01.0.21 only

Published 2026-04-21. Last modified 2026-06-17.