CVE-2026-38835
Command Injection in Tenda W30E USB Partition Function
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | w30e_firmware | 16.01.0.21 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-38835 is a command injection vulnerability found in the Tenda W30E V2.0 router running firmware version V16.01.0.21. The flaw exists in the function formSetUSBPartitionUmount and is exploitable via the usbPartitionName parameter.
An attacker can send a specially crafted HTTP POST request to the endpoint /goform/module?1774654724185 with a JSON payload containing malicious commands embedded in the usbPartitionName field. This allows the attacker to execute arbitrary shell commands on the device remotely.
For example, a proof-of-concept shows that an attacker can append arbitrary text to files on the device, demonstrating the ability to run commands without proper input sanitization.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary commands on the affected router. This can lead to unauthorized control over the device.
- Attackers could modify device files or configurations.
- They could potentially use the device as a foothold to launch further attacks within the network.
- It may result in service disruption or compromise of network security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /goform/module?1774654724185 on the Tenda W30EV2.0 router running firmware V16.01.0.21.
The POST request should contain a JSON payload with a malicious command embedded in the usbPartitionName parameter to test for command injection.
For example, the following JSON body can be used to test the vulnerability by attempting to append a string to a file on the device:
- { "setUmountUSBPartition": { "usbPartitionName": "\n echo pwned2!>>/webroot_ro/index.html\n" } }
If the string "pwned2!" appears in the /webroot_ro/index.html file on the device, it confirms successful command injection.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-38835 vulnerability, immediately avoid exposing the affected Tenda W30E V2.0 router running firmware version V16.01.0.21 to untrusted networks.
Restrict access to the router's management interface, especially the endpoint `/goform/module?1774654724185`, to trusted users only.
Monitor for unusual activity or unexpected changes in files such as `/webroot_ro/index.html` that may indicate exploitation attempts.
If possible, disable USB partition unmounting features or related services until a firmware update or patch is available.
Check for firmware updates from Tenda that address this command injection vulnerability and apply them as soon as they become available.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-38835 vulnerability allows remote attackers to execute arbitrary commands on the affected Tenda W30E router due to improper input sanitization. Such unauthorized command execution can lead to unauthorized access, data manipulation, or disruption of device functionality.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that enable arbitrary command execution on network devices can potentially compromise the confidentiality, integrity, and availability of data. This may result in non-compliance with regulations that require protection of personal or sensitive information.
Therefore, organizations using the affected device should consider this vulnerability a risk to regulatory compliance frameworks that mandate secure handling of data and network security controls.