Tenda Ac6 vulnerabilities, page 5

109 vulnerabilities

Known vulnerabilities in Tenda Ac6, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CriticalCVE-2024-10697tenda · ac6_firmwareTenda AC6 API Endpoint WriteFacMac formWriteFacMac command injectionA vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS26.17%9CriticalCVE-2026-4961tenda · ac6_firmwareTenda AC6 POST Request QuickIndex formQuickIndex stack-based overflowA vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.EPSS1.01%9CriticalCVE-2026-4960tenda · ac6_firmwareTenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflowA vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.EPSS1.01%7.2HighCVE-2026-8259tenda · ac6_firmwareTenda AC6 httpd telnet os command injectionA vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.EPSS8.31%7.2HighCVE-2026-8265tenda · ac6_firmwareTenda AC6 httpd getLogFile get_log_file os command injectionA security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.EPSS8.31%9.8CriticalCVE-2026-8263tenda · ac10u_firmware +1 moreTenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injectionA security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.EPSS8.69%8.8HighCVE-2026-8264tenda · ac6_firmwareTenda AC6 httpd WifiApScan formWifiApScan os command injectionA weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.EPSS6.47%9.8CriticalCVE-2023-40847tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." In the function, it reads in a user-provided parameter, and the variable is passed to the function without any length check.EPSS0.68%9.8CriticalCVE-2023-40837tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters to the "sub_ADD50" function to execute commands.EPSS0.91%9.8CriticalCVE-2023-40844tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'EPSS0.68%9.8CriticalCVE-2023-40839tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters to the "sub_ADF3C" function to execute commands.EPSS1.04%9.8CriticalCVE-2023-40841tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "add_white_node,"EPSS0.68%9.8CriticalCVE-2023-40845tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'sub_34FD0.' In the function, it reads user provided parameters and passes variables to the function without any length checks.EPSS0.68%9.8CriticalCVE-2023-40830tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.EPSS0.82%9.8CriticalCVE-2023-40840tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "fromGetWirelessRepeat."EPSS0.68%9.8CriticalCVE-2023-40842tenda · ac6_firmwaretenda ac6_firmwareTengda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "R7WebsSecurityHandler."EPSS0.68%9.8CriticalCVE-2023-40838tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability.EPSS1.15%9.8CriticalCVE-2023-40843tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "sub_73004."EPSS0.68%9.8CriticalCVE-2023-40848tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "sub_7D858."EPSS0.68%9.8CriticalCVE-2023-40846tenda · ac6_firmwaretenda ac6_firmwareTenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function sub_90998.EPSS0.84%