Tenda W30E V2 Cross-Site Request Forgery Vulnerability in Administrative Endpoints

A cross-site request forgery (CSRF) vulnerability has been identified in the Tenda W30E V2 router, affecting firmware versions through V16.01.0.19(5037). The vulnerability arises from the absence of CSRF protections on administrative endpoints, including those for changing administrator account credentials. This lack of protection allows attackers to craft malicious requests that, when executed by an authenticated user's browser, can alter administrative passwords and other configuration settings.

Impact

Exploitation of this vulnerability allows for unauthorized changes to administrative passwords and configuration settings on the affected router.