Tendacn vulnerabilities, page 3

146 vulnerabilities

Known vulnerabilities in Tendacn products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 24 products.

7.2HighCVE-2020-28093tendacn · ac1200_firmwaretendacn ac1200_firmwareOn Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.EPSS1.18%9.8CriticalCVE-2022-40853tendacn · ac15_firmwaretendacn ac15_firmwareTenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_setEPSS1.17%9.8CriticalCVE-2022-40860tendacn · ac15_firmwaretendacn ac15_firmwareTenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with request /goform/SetNetControlListEPSS1.17%9.8CriticalCVE-2022-40865tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/EPSS1.47%9.8CriticalCVE-2022-40864tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSetEPSS1.62%9.8CriticalCVE-2022-40862tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with the request /goform/NatStaticSettingEPSS1.47%9.8CriticalCVE-2022-40869tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","list").EPSS1.47%7.8HighCVE-2022-26243tendacn · ac10_firmwaretendacn ac10_firmwareTenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.EPSS1.18%10CriticalCVE-2022-31446tendacn · ac18_firmwaretendacn ac18_firmwareTenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.EPSS34.84%5.5MediumCVE-2022-36233tendacn · ac9_firmwaretendacn ac9_firmwareTenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd.EPSS0.25%7.5HighCVE-2022-36552tendacn · ac6_firmwaretendacn ac6_firmwareTenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request.EPSS0.70%9.8CriticalCVE-2022-37176tendacn · ac6_firmwaretendacn ac6_firmwareTenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into open security mode via a crafted packet sent to goform/setWizard.EPSS0.90%9.8CriticalCVE-2022-38326tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.EPSS1.13%9.8CriticalCVE-2022-38325tendacn · ac15_firmware +1 moretendacn ac15_firmwareTenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /goform/expandDlnaFile.EPSS1.13%9.8CriticalCVE-2022-24170tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.EPSS2.96%7.8HighCVE-2022-24164tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsHijackRule parameter.EPSS1.18%9.8CriticalCVE-2022-24165tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.EPSS2.96%7.8HighCVE-2022-24172tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.EPSS1.18%9.8CriticalCVE-2022-24167tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.EPSS2.96%7.8HighCVE-2022-24166tendacn · g1_firmware +1 moretendacn g1_firmwareTenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter.EPSS1.18%