Tenda vulnerabilities

1,959 vulnerabilities

Known vulnerabilities in Tenda products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 148 products.

Products

50 of 148
  • Ac6109 vulnerabilities
  • Ac18105 vulnerabilities
  • Ac1094 vulnerabilities
  • Ac994 vulnerabilities
  • Ac1586 vulnerabilities
  • Ac772 vulnerabilities
  • Ac863 vulnerabilities
  • Fh120263 vulnerabilities
  • W30E63 vulnerabilities
  • Ax180661 vulnerabilities
  • Ax180360 vulnerabilities
  • Ax353 vulnerabilities
  • Ac120648 vulnerabilities
  • M345 vulnerabilities
  • Ch2244 vulnerabilities
  • Ac541 vulnerabilities
  • Fh120639 vulnerabilities
  • Fh120335 vulnerabilities
  • F120334 vulnerabilities
  • Ax1231 vulnerabilities
  • W15E31 vulnerabilities
  • W20E31 vulnerabilities
  • F45330 vulnerabilities
  • Ac10U29 vulnerabilities
  • Ac2129 vulnerabilities
  • Fh120529 vulnerabilities
  • Fh45129 vulnerabilities
  • Ac2328 vulnerabilities
  • F120228 vulnerabilities
  • F45628 vulnerabilities
  • O326 vulnerabilities
  • Fh120125 vulnerabilities
  • G325 vulnerabilities
  • A1522 vulnerabilities
  • F45121 vulnerabilities
  • Wh45021 vulnerabilities
  • Ac2020 vulnerabilities
  • I2119 vulnerabilities
  • W919 vulnerabilities
  • I2217 vulnerabilities
  • Rx317 vulnerabilities
  • Ac50016 vulnerabilities
  • Cp316 vulnerabilities
  • Tx315 vulnerabilities
  • W18E15 vulnerabilities
  • Hg1014 vulnerabilities
  • W1213 vulnerabilities
  • 4G30012 vulnerabilities
  • A1811 vulnerabilities
  • Ax911 vulnerabilities
9.9CVE-2026-114268tendabe3l proA flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.10CVE-2026-113744tendaac19
EPSS score
0.62%
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.7.8CVE-2018-14559tendaac10_firmware+2
EPSS score
1.43%
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the list parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.10CVE-2018-14558tendaac10_firmware+2KEV
EPSS score
8.51%
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.7.8CVE-2018-14557tendaac10_firmware+2
EPSS score
1.43%
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the page parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, a causing buffer overflow.9.8CVE-2018-25316tendaw308r_firmware+1
EPSS score
0.65%
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.9.8CVE-2018-25318tendaa300_firmware+2
EPSS score
0.65%
Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites.9.8CVE-2018-25317tendaa302_firmware+2
EPSS score
0.65%
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.7.8CVE-2018-18732tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.9.8CVE-2018-18729tendaac10_firmware+4
EPSS score
1.35%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request, the value is directly used in a strcpy to a variable placed on the heap, which can leak sensitive information or even hijack program control flow.7.8CVE-2018-18708tendaac10_firmware+4
EPSS score
1.43%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromAddressNat" for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18706tendaac10_firmware+4
EPSS score
1.15%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromDhcpListClient" for a request, it is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18731tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18709tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "firewallEn" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18707tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "ssid" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18727tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.7.8CVE-2018-18730tendaac10_firmware+4
EPSS score
1.14%
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.9.8CVE-2018-18728tendaac15_firmware+2
EPSS score
2.96%
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.4.9CVE-2021-40546tendaac6_firmware
EPSS score
0.73%
Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi.8.7CVE-2021-47802shenzhen tenda technology co.,ltd.tenda d151 & d301+2
EPSS score
0.70%
Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.