CVE-2026-38834: Command Injection
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the dopingaction function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38834?
CVE-2026-38834 has a high severity level due to the potential for arbitrary command execution.
How do I fix CVE-2026-38834?
To fix CVE-2026-38834, update the Tenda W30E V2.0 to a version that addresses the command injection vulnerability.
What systems are affected by CVE-2026-38834?
CVE-2026-38834 specifically affects Tenda W30E V2.0 devices running firmware version V16.01.0.21.
What type of attack does CVE-2026-38834 allow?
CVE-2026-38834 allows attackers to execute arbitrary commands on the device via a crafted request.
Is CVE-2026-38834 a local or remote vulnerability?
CVE-2026-38834 is considered a remote vulnerability, as it can be exploited across the network without physical access to the device.