Tenda Ax9 vulnerabilities
11 vulnerabilities
Known vulnerabilities in Tenda Ax9, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2025-14636tenda · ax9_firmwareTenda AX9 httpd image_check weak hashA security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.EPSS0.29%HighCVE-2024-39963tenda · ax12_firmware +1 moretenda ax12_firmwareAX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg.EPSS1.52%HighCVE-2023-47422tenda · ax12_firmware +3 moretenda ax12_firmwareAn access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL.EPSS0.49%CriticalCVE-2023-49431tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.EPSS2.41%CriticalCVE-2023-49429tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules.EPSS2.41%CriticalCVE-2023-49433tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.EPSS0.92%CriticalCVE-2023-49434tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList.EPSS0.92%CriticalCVE-2023-49435tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 is vulnerable to command injection.EPSS2.41%CriticalCVE-2023-49436tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.EPSS2.41%CriticalCVE-2023-49430tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg.EPSS0.92%CriticalCVE-2023-49432tenda · ax9_firmwaretenda ax9_firmwareTenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.EPSS0.92%