Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration file containing plaintext administrator credentials, leading to sensitive information disclosure and potential remote administrative access.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-30140 Tenda W15E Router Unauthenticated Configuration File Disclosure Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30140
Post summary
The post simply announces CVE-2026-30140 and provides a link to a vulnerability details page with a brief description of a configuration file disclosure issue.
CVE-2026-30140 An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint… https://www.cve.org/CVERecord?id=CVE-2026-30140
Post summary
The CVE highlights an access‑control flaw in the Tenda W15E router enabling unauthenticated attackers to retrieve a config image from a specific endpoint.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tenda | w15e | - | - | - |
| OS | tenda | w15e_firmware | 02.03.01.26_cn | - | - |