Tenda W30E routers running firmware V2.0 V16.01.0.21 are vulnerable to a command injection flaw in the do_ping_action function via the hostName parameter. This weakness allows an attacker to craft a request that causes the router to execute arbitrary operating‑system commands with the privileges of the web service, leading to full compromise of the device. The vulnerability falls under the category of OS Command Injection (CWE‑77).

The only affected system documented is the Tenda W30E wireless router running firmware V2.0 V16.01.0.21. No additional vendor or product versions are listed.

Tenda W30E routers exposed to the web management interface are vulnerable to remote code execution via a crafted HTTP request that triggers the do_ping_action function. The EPSS score of 3% indicates a relatively low but non‑zero likelihood of exploitation. The vulnerability has not been listed in the CISA KEV catalog, and there is no known evidence of widespread exploitation; however, the potential impact remains high if the interface is reachable. The CVSS score of 7.3 points to a high severity.