Tenda vulnerabilities, page 3
1,959 vulnerabilities
Known vulnerabilities in Tenda products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 148 products.
HighCVE-2025-63152tenda · ax3_firmwaretenda ax3_firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63454tenda · ax3_firmwaretenda ax3_firmwareTenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63149tenda · ax3_firmwaretenda ax3_firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63147tenda · ax3_firmwaretenda ax3_firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63456tenda · ax1803_firmwaretenda ax1803_firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%CriticalCVE-2025-63666tenda · ac15_firmwaretenda ac15_firmwareTenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.EPSS0.50%HighCVE-2025-63835tenda · ac18_firmwaretenda ac18_firmwareA stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the guestSsid parameter of the /goform/WifiGuestSet interface. Remote attackers can exploit this vulnerability by sending oversized data to the guestSsid parameter, leading to denial of service (device crash) or potential remote code execution.EPSS0.69%MediumCVE-2025-63834tenda · ac18_firmwaretenda ac18_firmwareA stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.EPSS0.24%HighCVE-2025-63458tenda · ax1803_firmwaretenda ax1803_firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63457tenda · ax1803_firmwaretenda ax1803_firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.40%HighCVE-2025-63455tenda · ax3_firmwaretenda ax3_firmwareTenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.41%MediumCVE-2025-2990tenda · fh1202_firmwareTenda FH1202 Web Management Interface AdvSetWrlGstset access controlA vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/AdvSetWrlGstset of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS0.65%MediumCVE-2025-2994tenda · fh1202_firmwareTenda FH1202 Web Management Interface qossetting access controlA vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects an unknown part of the file /goform/qossetting of the component Web Management Interface. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.EPSS0.65%MediumCVE-2025-2996tenda · fh1202_firmwareTenda FH1202 Web Management Interface SysToolDDNS access controlA vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /goform/SysToolDDNS of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS0.81%MediumCVE-2025-2989tenda · fh1202_firmwareTenda FH1202 Web Management Interface AdvSetWrl access controlA vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/AdvSetWrl of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS0.65%MediumCVE-2025-2992tenda · fh1202_firmwareTenda FH1202 Web Management Interface AdvSetWrlsafeset access controlA vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is an unknown functionality of the file /goform/AdvSetWrlsafeset of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS0.66%MediumCVE-2025-2991tenda · fh1202_firmwareTenda FH1202 Web Management Interface AdvSetWrlmacfilter access controlA vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is an unknown function of the file /goform/AdvSetWrlmacfilter of the component Web Management Interface. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.EPSS0.64%MediumCVE-2025-2995tenda · fh1202_firmwareTenda FH1202 Web Management Interface SysToolChangePwd access controlA vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolChangePwd of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS0.83%MediumCVE-2025-2993tenda · fh1202_firmwareTenda FH1202 default.cfg access controlA vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.EPSS10.94%CriticalCVE-2025-13446tenda · ac21_firmwareTenda AC21 SetSysTimeCfg stack-based overflowA vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.EPSS4.21%