Command injection exists in the formSetUSBPartitionUmount function of the Tenda W30E router. By supplying a crafted usbPartitionName value, an attacker can inject and execute arbitrary operating‑system commands on the device. The vulnerability allows full control over the router with the privileges of the firmware, which can lead to compromise of the entire network or further lateral movement.

The issue affects devices running Tenda W30E firmware version V2.0 V16.01.0.21. No other vendors or product releases are listed as impacted.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of < 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector for exploitation is via the router’s web interface, typically from a local network or through compromised credentials. No official patch or workaround has been released yet.