An incorrect authorization flaw in the user management API of the Shenzhen Tenda W30E V2 router allows a low‑privileged authenticated user to change the administrator account password by sending a crafted request directly to the backend endpoint. This bypasses the role‑based restrictions enforced by the web interface and grants the attacker full administrative privileges, effectively resulting in complete control over the device. The weakness is classified as CWE‑863, Improper Authorization, and does not directly lead to remote code execution.

Firmware versions of the Tenda W30E V2 router up to and including V16.01.0.19(5037) are affected. The vulnerability exists in the user management API exposed by the device’s web interface.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a very low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by authenticating with any low‑privileged account and sending a specially crafted request to the backend endpoint, thereby bypassing the web interface’s role checks and changing the administrator password.