Tenda W30E V2 Authorization Flaw Allows Password Change for Administrator Account

An authorization vulnerability has been identified in the user management API of the Tenda W30E V2 router, affecting firmware versions through V16.01.0.19(5037). This flaw allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request to the backend endpoint, an attacker can bypass the role-based restrictions of the web interface and gain full administrative privileges.

Impact

Exploitation of this vulnerability allows for unauthorized password changes on the administrator account, potentially leading to unauthorized administrative access.