Shenzhen Tenda W30E V2 firmware through V16.01.0.19 serves sensitive administrative content without proper cache‑control headers. This omission allows browsers to store credential‑bearing responses, enabling anyone who can later access the browser cache to retrieve administrative credentials. The vulnerability does not grant arbitrary code execution but exposes stored credentials to subsequent unauthorized use.

The affected devices are Tenda W30E V2 routers manufactured by Shenzhen Tenda Technology Co., Ltd. All firmware releases up to and including V16.01.0.19 (item number 5037) are vulnerable; newer firmware codes are not documented as affected.

The CVSS score of 4.8 indicates a moderate impact. The low EPSS (<1%) reflects that exploitation is unlikely in the wild, and the vulnerability is not currently in CISA's KEV catalog. The attack scenario requires an attacker to persuade a legitimate user to load an administrative page in a browser that then preserves the response offline; thereafter the attacker or an opportunistic third party can retrieve cached credentials. Because the flaw only affects cached local content, the risk is confined to environments where users leave credentials stored or share machines.