Tenda Ac6 vulnerabilities, page 2
109 vulnerabilities
Known vulnerabilities in Tenda Ac6, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2025-57528tenda · ac6_firmwaretenda ac6_firmwareAn issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm).EPSS0.44%MediumCVE-2025-57296tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device.EPSS3.29%HighCVE-2025-46035tenda · ac6_firmwaretenda ac6_firmwareBuffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpointEPSS0.63%CriticalCVE-2025-5854tenda · ac6_firmwareTenda AC6 AdvSetLanip fromadvsetlanip buffer overflowA vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.EPSS0.98%CriticalCVE-2025-5852tenda · ac6_firmwareTenda AC6 setPptpUserList formSetPPTPUserList buffer overflowA vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.EPSS1.01%CriticalCVE-2025-5855tenda · ac6_firmwareTenda AC6 SetRebootTimer formSetRebootTimer stack-based overflowA vulnerability, which was classified as critical, was found in Tenda AC6 15.03.05.16. This affects the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.EPSS1.05%CriticalCVE-2025-5853tenda · ac6_firmwareTenda AC6 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflowA vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg. The manipulation of the argument remoteIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS7.25%MediumCVE-2025-44172tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.EPSS0.28%HighCVE-2025-24496tenda · ac6_firmware +1 moretenda ac6_firmwareAn information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.EPSS0.37%CriticalCVE-2025-24322tenda · ac6_firmware +1 moretenda ac6_firmwareAn unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability.EPSS0.57%HighCVE-2025-70252tenda · ac6_firmwaretenda ac6_firmwareAn issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.EPSS0.47%CriticalCVE-2025-32010tenda · ac6_firmware +1 moretenda ac6_firmwareA stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.EPSS0.69%HighCVE-2025-30256tenda · ac6_firmware +1 moretenda ac6_firmwareA denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests can lead to a reboot. An attacker can send multiple network packets to trigger this vulnerability.EPSS0.39%CriticalCVE-2025-12225tenda · ac6_firmwareTenda AC6 HTTP Request WifiGuestSet stack-based overflowA vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Request Handler. Such manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.EPSS1.03%HighCVE-2025-50263tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the list parameter.EPSS0.46%HighCVE-2025-50262tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetQosBand function via the list parameter.EPSS0.45%HighCVE-2025-50258tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter.EPSS0.46%MediumCVE-2025-50641tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId.EPSS0.43%HighCVE-2025-50260tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function via the firewallEn parameter.EPSS0.45%HighCVE-2025-50528tenda · ac6_firmwaretenda ac6_firmwareA buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.EPSS0.38%