Tenda
Monthly
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in Tenda F456 1.0.0.5 httpd allows authenticated remote attackers to execute arbitrary commands via the mac parameter in the /goform/WriteFacMac endpoint. The vulnerability has a publicly available exploit and CVSS 5.3 score with authenticated access requirement (PR:L), limiting immediate widespread risk but affecting exposed or compromised administrative accounts.
Path traversal in Tenda i9 router firmware version 1.0.0.5(2204) allows remote unauthenticated attackers to access arbitrary files, modify system configurations, and potentially disrupt device operation via the R7WebsSecurityHandlerfunction in the HTTP Handler component. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new), enabling straightforward exploitation with EPSS-assessed risk. The vulnerability permits confidentiality, integrity, and availability impacts with low attack complexity and no required user interaction, making it a realistic target for automated scanning and exploitation.
Command injection in Tenda F453 firmware up to version 1.0.0.3 allows authenticated remote attackers to execute arbitrary system commands via the TendaTelnet function in the /goform/telnet endpoint. The vulnerability has publicly available exploit code and may be actively used against deployed devices. Attack requires low-privilege authentication but carries significant risk due to the telnet service's direct command execution capability.
Path traversal in Tenda i6 router firmware 1.0.0.7(2204) allows unauthenticated remote attackers to read, write, or delete arbitrary files via malicious HTTP requests to the R7WebsSecurityHandlerfunction component. CVSS 7.3 (High) reflects network-accessible exploitation without authentication. Publicly available exploit code exists, documented in a GitHub repository demonstrating attack vectors. Affects Tenda i6 wireless router deployments running vulnerable firmware version.
Remote path traversal in Tenda CH22 1.0.0.6(468) httpd component allows unauthenticated attackers to access arbitrary files via the R7WebsSecurityHandlerfunction, with publicly available exploit code and a CVSS score of 6.9 indicating moderate real-world risk despite the low scope of impact (information disclosure only).
Path traversal in Tenda i12 router firmware 1.0.0.11(3862) allows unauthenticated remote attackers to read, modify, or delete arbitrary files via malicious HTTP requests to an unidentified handler component. The vulnerability enables unauthorized access to the filesystem with low integrity and confidentiality impact. Publicly available exploit code exists, increasing the likelihood of opportunistic attacks against exposed devices.
Path traversal vulnerability in Tenda i3 router firmware version 1.0.0.6(2204) allows unauthenticated remote attackers to access arbitrary files via manipulation of the R7WebsSecurityHandler HTTP handler component. The vulnerability has a CVSS score of 6.9 (low confidentiality and integrity impact), publicly available exploit code exists, and exploitation requires only network access with no user interaction.
Buffer overflow in Tenda AC6 router firmware version 15.03.05.16_multi enables unauthenticated remote denial-of-service attacks via crafted HTTP requests to formSetCfm function. Attackers can trigger service disruption by sending malicious funcname, funcpara1, or funcpara2 parameters without authentication. The network-accessible attack vector with low complexity makes this exploitable from the internet. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to cause memory corruption via manipulation of the page parameter in the P2pListFilter function. The vulnerability requires local network access and authenticated privileges but carries publicly available exploit code, elevating practical risk despite the moderate CVSS score of 5.1.
Tenda AC10 router firmware 16.03.10.10_multi_TDE01 exposes a hard-coded RSA 2048-bit private key in the world-readable file /webroot_ro/pem/privkeySrv.pem, allowing unauthenticated remote attackers to retrieve sensitive cryptographic material and decrypt encrypted communications. With publicly available exploit code and an EPSS score indicating moderate but real-world feasibility, this vulnerability enables information disclosure attacks against affected router configurations.
OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arbitrary system commands via the formAddMacfilterRule function in /bin/httpd. The vulnerability requires valid credentials (PR:L in CVSS vector) and affects multiple endpoints related to MAC filtering configuration. No public exploit code has been independently confirmed as actively exploited, though proof-of-concept documentation exists in public repositories.
Tenda 4G03 Pro wireless router contains a hard-coded ECDSA P-256 private cryptographic key in the /etc/www/pem/server.key file, enabling remote attackers to decrypt HTTPS communications and potentially impersonate the device without authentication. The vulnerability affects firmware versions 1.0, 1.0re, 01.bin, and 04.03.01.53, and carries a CVSS score of 5.3 with proof-of-concept exploitation likely (E:P rating). No public exploit code has been independently confirmed at the time of this analysis.
Improper access controls in Tenda 4G03 Pro firmware (versions up to 04.03.01.53) enable unauthenticated remote attackers to bypass authentication mechanisms via the /bin/httpd binary, potentially achieving unauthorized administrative access to the router. This vulnerability has publicly available exploit code and affects consumer-grade 4G routers commonly used for home and small office networks. EPSS data not available, but the combination of network-accessible attack vector, low complexity, and public exploit elevates real-world risk.
Command injection in Tenda G103 1.0.0.5 allows high-privileged remote attackers to execute arbitrary commands via the lanIp parameter in the action_set_system_settings function of system.lua. The vulnerability requires administrative credentials (PR:H) but has publicly available exploit code and impacts system confidentiality, integrity, and availability. CVSS score 5.1 reflects the elevated privilege requirement despite network-based attack vector.
Command injection in Tenda G103 1.0.0.5 setting handler allows high-privilege remote attackers to execute arbitrary commands via manipulation of multiple GPON authentication parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) in the gpon.lua component. Publicly available exploit code exists, though the CVSS:3.1/AV:N/AC:L/PR:H vector indicates attacks require high administrative privileges and deliver limited impact (confidentiality, integrity, availability each L). This is a realistic but constrained threat: exploitation requires authenticated admin-level access to a device already on the network.
Command injection in Tenda CH22 1.0.0.1 via the FormWriteFacMac function allows authenticated remote attackers to execute arbitrary commands by manipulating the mac parameter in the /goform/WriteFacMac endpoint. Publicly available exploit code exists for this vulnerability, which carries a CVSS score of 6.3 and requires low-privilege authentication to trigger.
Unauthenticated attackers can execute arbitrary commands on Tenda F453 routers (version 1.0.0.3) by injecting malicious input through the mac parameter in the /goform/WriteFacMac endpoint. Public exploit code exists for this vulnerability, enabling remote code execution with minimal attack complexity. A patch is not currently available.
OS command injection in Tenda AC8 16.03.50.11 web interface allows authenticated remote attackers to execute arbitrary commands through the wans.policy.list1 parameter in the /cgi-bin/UploadCfg endpoint. Public exploit code exists for this vulnerability and no patch is currently available.
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption and enable remote code execution. [CVSS 7.5 HIGH]
An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. [CVSS 7.5 HIGH]
F3 Firmware contains a vulnerability that allows attackers to the response to be stored in client-side caches and recovered by other local use (CVSS 6.5).
The Tenda F3 Wireless Router firmware lacks CSRF protections in its administrative interface, enabling attackers to trick authenticated administrators into making unauthorized configuration changes through crafted requests. An unauthenticated attacker can exploit this to modify router settings by socially engineering an admin into visiting a malicious webpage. No patch is currently available for this vulnerability.
Tenda F3 Wireless Router firmware V12.01.01.55_multi is vulnerable to reflected cross-site scripting (XSS) in its administrative interface due to missing MIME-sniffing protections and insufficient input validation. An unauthenticated attacker can inject malicious scripts that execute in the context of the admin interface when a user visits a crafted link, potentially leading to administrative account compromise. No patch is currently available for this vulnerability.
Tenda F3 Wireless Router firmware V12.01.01.55_multi lacks clickjacking protections in its web administrative interface, enabling attackers to embed configuration pages in iframes and manipulate authenticated administrators into making unauthorized changes. Public exploit code exists for this vulnerability, affecting administrators who access the router's management interface. While the impact is limited to configuration tampering rather than direct compromise, the lack of available patches leaves affected devices vulnerable.
Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CGI handler. [CVSS 7.5 HIGH]
Stack buffer overflow in Tenda A18 15.13.07.13 firmware allows authenticated remote attackers to execute arbitrary code through malformed boundary parameters in the /cgi-bin/UploadCfg HTTP endpoint. The vulnerability affects the webCgiGetUploadFile function within the Httpd service and has public exploit code available. Affected users should apply patches when available, as the vulnerability requires valid credentials but no user interaction.
Tenda AC21 firmware version 16.03.08.16 contains an information disclosure vulnerability in the /cgi-bin/DownloadFlash web management interface that allows unauthenticated remote attackers to access sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at risk of data exposure.
Tenda AC21 firmware version 16.03.08.16 contains an information disclosure vulnerability in the web management interface's /cgi-bin/DownloadLog endpoint that allows unauthenticated remote attackers to access sensitive data. Public exploit code is available for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected devices.
Tenda AC7 firmware V03.03.03.01_cn and earlier transmits account credentials in cleartext over HTTP, enabling network-positioned attackers to intercept and obtain authentication material without user interaction. This cleartext credential exposure in HTTP responses creates a high confidentiality risk for affected device users. No patch is currently available for this vulnerability.
Tenda AC7 firmware through V03.03.03.01_cn lacks CSRF protections on administrative web functions, enabling attackers to trick authenticated administrators into executing unauthorized configuration changes. An unauthenticated attacker can craft malicious requests that, when visited by an admin, modify router settings without their knowledge or consent. No patch is currently available.
Tenda AC7 firmware v03.03.03.01_cn and earlier transmits administrative credentials in plaintext within web management responses and fails to set proper Cache-Control headers, allowing credentials to be cached by browsers. A local attacker with access to a client system or browser profile can retrieve these cached credentials to gain unauthorized administrative access to affected routers. No patch is currently available for this vulnerability.
The Tenda AC7 firmware web management interface fails to properly sanitize user input, enabling reflected cross-site scripting (XSS) attacks that can inject malicious scripts into a victim's browser. An unauthenticated attacker can exploit this vulnerability to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. No patch is currently available for affected firmware versions V03.03.03.01_cn and earlier.
Command injection in Tenda HG10 firmware allows remote attackers with high privileges to execute arbitrary system commands via the sysCmd parameter in /boaform/formSysCmd. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker can exploit this to achieve limited unauthorized access and potential system compromise.
Command injection in Tenda HG10 firmware's login interface allows unauthenticated remote attackers to execute arbitrary commands by manipulating the Host parameter in the checkUserFromLanOrWan function. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can fully compromise affected devices through remote code execution.
Hg10 Firmware versions up to - contains a vulnerability that allows attackers to command injection (CVSS 7.3).
Command injection in Tenda AC21 firmware versions 1.1.1.1/1.dmzip/16.03.08.16 allows authenticated remote attackers to execute arbitrary commands via the dmzIp parameter in the mDMZSetCfg function. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Tenda W30E firmware versions through V16.01.0.19(5037) omit the X-Content-Type-Options: nosniff header from web management interfaces, enabling MIME type confusion attacks. An unauthenticated remote attacker can exploit this to inject malicious scripts that browsers may execute as legitimate content, potentially compromising the integrity and confidentiality of management traffic. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through version 16.01.0.19(5037) fails to implement proper cache-control headers on sensitive administrative responses, allowing a local authenticated attacker to retrieve cached credentials from the browser's storage. This high-confidentiality impact vulnerability has no available patch and affects users on vulnerable firmware versions.
Tenda W30E firmware through V16.01.0.19(5037) is vulnerable to CORS misconfiguration that permits authenticated administrative endpoints to accept credentialed cross-origin requests from arbitrary origins. An authenticated attacker can exploit this vulnerability to perform unauthorized actions on affected devices by tricking administrators into visiting malicious web pages. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through V16.01.0.19(5037) fails to properly sanitize user input during account creation, allowing authenticated attackers to inject persistent malicious scripts that execute in administrators' browsers when accessing management pages. This stored XSS vulnerability enables session hijacking, credential theft, and unauthorized configuration changes with low complexity exploitation requiring only user interaction from an admin. No patch is currently available for affected devices.
Tenda W30E V2 firmware through V16.01.0.19(5037) lacks CSRF protections on administrative functions, enabling attackers to hijack authenticated admin sessions and modify configuration settings or reset administrator credentials. An attacker can craft malicious requests that execute with the privileges of a logged-in administrator when visited in their browser. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through V16.01.0.19(5037) exposes stored administrative passwords in plaintext on the management interface, allowing any authenticated user to retrieve credentials. This information disclosure affects administrative account security and could enable privilege escalation or lateral movement. No patch is currently available.
Tenda AX3 firmware has another stack-based buffer overflow in formGetIptv through a different input path, enabling remote code execution.
Tenda AX3 firmware has a third stack-based buffer overflow in formGetIptv, allowing unauthenticated remote code execution through the router's web interface.
Tenda AX3 firmware has a second stack overflow in formSetIptv via the vlanId parameter, allowing remote code execution through the IPTV configuration endpoint.
Tenda AX3 firmware v16.03.12.11 has a stack overflow in formSetIptv via the list parameter, enabling remote attackers to crash the router or execute arbitrary code.
D151 Firmware versions up to - is affected by missing authentication for critical function (CVSS 7.5).
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Ac1206 Firmware versions up to 15.03.06.23 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Hard-coded credentials in the shadow file component of multiple Tenda network devices (i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G, TEG5328F) allow local authenticated attackers to gain high-privilege access. Public exploit code is available on GitHub, enabling authentication bypass on devices running firmware versions up to 65.10.15.6. The CWE-259 classification indicates credentials embedded in firmware that cannot be changed through normal configuration. With EPSS data unavailable and no CISA KEV listing, this appears to affect primarily SOHO and small business deployments where local access may be obtained through social engineering or physical access.
OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.
An authenticated heap-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) lets remote attackers corrupt memory through the /goform/setInternetLanInfo handler, potentially achieving high-impact confidentiality, integrity, and availability loss on the device. Exploitation requires network reachability to the device's HTTP management interface and at least low-privilege credentials (CVSS 4.0 vector PR:L), and a public proof-of-concept exploit has been released, raising the practical risk for exposed management UIs. EPSS is 2.88% (86th percentile), indicating elevated but not extreme likelihood of exploitation; there is no CISA KEV listing, so confirmed active exploitation has not been established at time of analysis.
Heap-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) allows an authenticated remote attacker to potentially execute arbitrary code or cause a denial of service by sending oversized values to specific advertising/SMS configuration parameters in the /goform/setAdInfoDetail endpoint. Publicly available exploit code exists for this flaw, though it is not confirmed as actively exploited (no CISA KEV listing). The CVSS 4.0 score is 7.4 (HIGH), and EPSS is 0.74% (53rd percentile).
Stack-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) allows a remote, low-privileged authenticated attacker to corrupt memory via the mac or terminal parameter of the /goform/setAdPushInfo endpoint handled by formSetAdPushInfo, with high impact to confidentiality, integrity and availability (CVSS 7.4; assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a GitHub write-up is referenced by NVD), but there is no indication of confirmed active exploitation (CISA KEV). Exploitation requires network reachability to the device's HTTP management service plus a valid low-privilege session, so on default deployments the realistic exposure is LAN-side unless remote administration has been enabled.
Stack-based buffer overflow in the Tenda M3 wireless router firmware (build 1.0.0.13(4903)) lets an authenticated attacker who can reach the device's web management interface crash or potentially execute code on the device by sending a single crafted request to the /goform/setVlanInfo endpoint with oversized ID, vlan, or port parameters. Exploitation requires a low-privilege authenticated session (CVSS PR:L) but no user interaction; publicly available exploit code exists (a proof-of-concept writeup is published on GitHub), and the CVSS v4.0 score of 7.4 with an E:P exploit-maturity flag reflects that a working exploit is already circulating, though there is no CISA KEV confirmation of real-world attacks. Devices whose management plane is exposed beyond a trusted LAN/VLAN or that retain default or shared admin credentials are at substantially higher risk.
Heap-based buffer overflow in the web management interface of Tenda M3 firmware 1.0.0.13(4903) allows authenticated attackers to achieve remote code execution or cause a denial of service by sending a crafted request to the /goform/setVlanPolicyData endpoint. The vulnerability has publicly available exploit code, and while the CVSS vector indicates a network attack vector with low privileges required, practical exploitation is limited to attackers who can reach the management interface, typically from the LAN or when remote administration is explicitly enabled. With high impact to confidentiality, integrity, and availability, this flaw poses a serious risk to affected devices.
Denial of service in Tenda CH22 routers (firmware through 1.0.0.1) allows remote unauthenticated attackers to crash the device by sending a crafted request with a manipulated LISTLEN argument to the /goform/DhcpListClient endpoint. Publicly available exploit code exists per the referenced GitHub issue, and no CISA KEV entry has been recorded; EPSS is 4.58% (91st percentile), indicating above-average attention. Impact is confined to availability (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, vendor CVSS 4.0 base 5.5), with no confidentiality or integrity exposure, keeping real-world priority well below a code-execution flaw.
Buffer overflow in Tenda AC10U firmware 15.03.06.48 and 15.03.06.49 through the /goform/AdvSetLanip endpoint's lanMask parameter allows a low-privilege authenticated attacker who can reach the router's web management interface to corrupt memory via a crafted POST request, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. The management interface is typically LAN-bound by default, so realistic exploitation requires local network access or deliberate exposure of the admin UI to the WAN.
Buffer overflow in Tenda AC23 firmware version 16.03.07.52 allows an authenticated remote attacker who can reach the device's HTTP management interface to corrupt memory by submitting a POST request to the formSetPPTPUserList handler with a manipulated 'list' argument, yielding high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 7.4, High). The attack is network-reachable with low complexity and no user interaction, but requires low-level privileges (CVSS PR:L), so it is not a pre-authentication flaw; practical exploitability from the internet depends on whether remote/WAN management is enabled, since the web UI is normally LAN-only. Publicly available exploit code exists, published in a Notion write-up referenced by NVD, though there is no confirmed active exploitation (not in CISA KEV).
An authenticated stack-based buffer overflow in Tenda AC23 firmware 16.03.07.52 allows remote attackers with valid management credentials to trigger memory corruption by sending an oversized bindnum parameter to /goform/SetIpMacBind, potentially enabling arbitrary code execution or a denial-of-service condition. Publicly available exploit code exists, and the independent assessment notes moderately aligned signals toward a real but bounded risk because exploitation requires management-plane access and the device has a low deployment footprint.
Tenda AC10U router firmware versions 15.03.06.48 and 15.03.06.49 contain a buffer overflow (CWE-119) in the formSetPPTPUserList handler for /goform/setPptpUserList, exploitable by sending an oversized 'list' parameter in an HTTP POST request. Successful exploitation can corrupt memory, potentially leading to remote code execution or device crash, with high impact on confidentiality, integrity, and availability. The CVSS vector indicates network attack (AV:N) with low attack complexity and privileges required (PR:L), though the endpoint is often unauthenticated on Tenda devices per independent assessment. Publicly available exploit code exists; no active exploitation in CISA KEV is confirmed. EPSS score is 0.70% (51st percentile).
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an attacker who can reach the device's administrative web service and supply a crafted 'page' argument to the /goform/webExcptypemanFilte endpoint to corrupt stack memory and potentially achieve arbitrary code execution with the privileges of the web server process. Per the vendor-supplied CVSS 4.0 vector (PR:H), the attacker must first hold privileged/authenticated access to the web interface, a requirement that significantly limits real-world exposure, though the endpoint's true pre-authentication reachability should be verified against the firmware. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no indication of confirmed active exploitation in the wild, and no vendor patch or advisory has been identified at time of analysis.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR:H) to execute arbitrary code via the 'page' parameter in the /goform/qossetting endpoint. Publicly available exploit code exists, and the CVSS v4.0 base score is 7.3 (High). Exploitation requires authenticated access to the router's web management interface, which is typically limited to the LAN unless exposed to the internet.
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user crash or potentially execute code on the device by sending an oversized 'page' parameter to the /goform/VirtualSer HTTP handler. The flaw is network-reachable (CVSS:4.0 base 7.3, AV:N/AC:L, PR:H, UI:N), so it requires an administrative session on the web management interface rather than pre-authentication access. Publicly available exploit code exists, including a proof-of-concept with reproduction steps published on GitHub, but there is no CISA KEV entry indicating confirmed in-the-wild exploitation. Successful abuse yields full loss of confidentiality, integrity, and availability on the router itself, though the assessed scope is unchanged (S:U) and no downstream systems are directly impacted.
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote administrator overwrite stack memory through the 'page' argument of the /goform/SetIpBind endpoint, enabling a denial-of-service crash and potentially arbitrary code execution on the device. Exploitation requires valid administrator credentials or an active admin session (CVSS PR:H); no user interaction is needed, and the device is not reachable by anonymous remote attackers in a properly-credentialed default configuration. Publicly available exploit code exists (a detailed BinaryAudit PoC with reproduction steps is published on GitHub), but there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch or fixed firmware version has been identified in the available data.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's HTTP management interface to corrupt memory by submitting an overlong 'page' parameter to /goform/SafeMacFilter, with high confidentiality, integrity, and availability impact if exploitation succeeds. Publicly available exploit code exists, but the attack is gated by the need for a privileged admin session (PR:H) and by LAN-side reachability of the management panel, which is not exposed to the internet by default. The vendor has not published a fixed firmware version in the available data, so risk is moderate rather than top-tier.
Stack-based buffer overflow in the Tenda WH450 router running firmware 1.0.0.18 lets an authenticated administrator crash or potentially execute code on the device by sending an oversized 'page' argument to the /goform/SafeEmailFilter handler, which is reachable remotely over the web management interface. Publicly available exploit code exists (a BinaryAudit PoC on GitHub) and the CVSS v4.0 base score is 7.3 with PR:H, confirming that a privileged session is a prerequisite; there is no evidence of confirmed active exploitation (not in CISA KEV). Impact is bounded to the device itself - no scope change to downstream systems - but the high integrity and availability sub-scores mean a successful attack can fully compromise the router's configuration. Risk is real but contained: the main gating factor is obtaining admin credentials (default or weak passwords on SOHO routers materially ease this), and exposure of the management UI to untrusted networks.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated administrator to corrupt memory and potentially execute arbitrary code by sending a crafted HTTP request to the /goform/RouteStatic endpoint with an oversized 'page' argument. Exploitation requires high-privilege credentials (CVSS PR:H) and network reachability to the router's management interface, which on SOHO devices is typically LAN-side rather than exposed to the WAN. Publicly available exploit code exists (a GitHub proof-of-concept walkthrough of the RouteStatic overflow), so the barrier to reproduction is low for anyone who already has admin access; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in Tenda F456 1.0.0.5 httpd allows authenticated remote attackers to execute arbitrary commands via the mac parameter in the /goform/WriteFacMac endpoint. The vulnerability has a publicly available exploit and CVSS 5.3 score with authenticated access requirement (PR:L), limiting immediate widespread risk but affecting exposed or compromised administrative accounts.
Path traversal in Tenda i9 router firmware version 1.0.0.5(2204) allows remote unauthenticated attackers to access arbitrary files, modify system configurations, and potentially disrupt device operation via the R7WebsSecurityHandlerfunction in the HTTP Handler component. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new), enabling straightforward exploitation with EPSS-assessed risk. The vulnerability permits confidentiality, integrity, and availability impacts with low attack complexity and no required user interaction, making it a realistic target for automated scanning and exploitation.
Command injection in Tenda F453 firmware up to version 1.0.0.3 allows authenticated remote attackers to execute arbitrary system commands via the TendaTelnet function in the /goform/telnet endpoint. The vulnerability has publicly available exploit code and may be actively used against deployed devices. Attack requires low-privilege authentication but carries significant risk due to the telnet service's direct command execution capability.
Path traversal in Tenda i6 router firmware 1.0.0.7(2204) allows unauthenticated remote attackers to read, write, or delete arbitrary files via malicious HTTP requests to the R7WebsSecurityHandlerfunction component. CVSS 7.3 (High) reflects network-accessible exploitation without authentication. Publicly available exploit code exists, documented in a GitHub repository demonstrating attack vectors. Affects Tenda i6 wireless router deployments running vulnerable firmware version.
Remote path traversal in Tenda CH22 1.0.0.6(468) httpd component allows unauthenticated attackers to access arbitrary files via the R7WebsSecurityHandlerfunction, with publicly available exploit code and a CVSS score of 6.9 indicating moderate real-world risk despite the low scope of impact (information disclosure only).
Path traversal in Tenda i12 router firmware 1.0.0.11(3862) allows unauthenticated remote attackers to read, modify, or delete arbitrary files via malicious HTTP requests to an unidentified handler component. The vulnerability enables unauthorized access to the filesystem with low integrity and confidentiality impact. Publicly available exploit code exists, increasing the likelihood of opportunistic attacks against exposed devices.
Path traversal vulnerability in Tenda i3 router firmware version 1.0.0.6(2204) allows unauthenticated remote attackers to access arbitrary files via manipulation of the R7WebsSecurityHandler HTTP handler component. The vulnerability has a CVSS score of 6.9 (low confidentiality and integrity impact), publicly available exploit code exists, and exploitation requires only network access with no user interaction.
Buffer overflow in Tenda AC6 router firmware version 15.03.05.16_multi enables unauthenticated remote denial-of-service attacks via crafted HTTP requests to formSetCfm function. Attackers can trigger service disruption by sending malicious funcname, funcpara1, or funcpara2 parameters without authentication. The network-accessible attack vector with low complexity makes this exploitable from the internet. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to cause memory corruption via manipulation of the page parameter in the P2pListFilter function. The vulnerability requires local network access and authenticated privileges but carries publicly available exploit code, elevating practical risk despite the moderate CVSS score of 5.1.
Tenda AC10 router firmware 16.03.10.10_multi_TDE01 exposes a hard-coded RSA 2048-bit private key in the world-readable file /webroot_ro/pem/privkeySrv.pem, allowing unauthenticated remote attackers to retrieve sensitive cryptographic material and decrypt encrypted communications. With publicly available exploit code and an EPSS score indicating moderate but real-world feasibility, this vulnerability enables information disclosure attacks against affected router configurations.
OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arbitrary system commands via the formAddMacfilterRule function in /bin/httpd. The vulnerability requires valid credentials (PR:L in CVSS vector) and affects multiple endpoints related to MAC filtering configuration. No public exploit code has been independently confirmed as actively exploited, though proof-of-concept documentation exists in public repositories.
Tenda 4G03 Pro wireless router contains a hard-coded ECDSA P-256 private cryptographic key in the /etc/www/pem/server.key file, enabling remote attackers to decrypt HTTPS communications and potentially impersonate the device without authentication. The vulnerability affects firmware versions 1.0, 1.0re, 01.bin, and 04.03.01.53, and carries a CVSS score of 5.3 with proof-of-concept exploitation likely (E:P rating). No public exploit code has been independently confirmed at the time of this analysis.
Improper access controls in Tenda 4G03 Pro firmware (versions up to 04.03.01.53) enable unauthenticated remote attackers to bypass authentication mechanisms via the /bin/httpd binary, potentially achieving unauthorized administrative access to the router. This vulnerability has publicly available exploit code and affects consumer-grade 4G routers commonly used for home and small office networks. EPSS data not available, but the combination of network-accessible attack vector, low complexity, and public exploit elevates real-world risk.
Command injection in Tenda G103 1.0.0.5 allows high-privileged remote attackers to execute arbitrary commands via the lanIp parameter in the action_set_system_settings function of system.lua. The vulnerability requires administrative credentials (PR:H) but has publicly available exploit code and impacts system confidentiality, integrity, and availability. CVSS score 5.1 reflects the elevated privilege requirement despite network-based attack vector.
Command injection in Tenda G103 1.0.0.5 setting handler allows high-privilege remote attackers to execute arbitrary commands via manipulation of multiple GPON authentication parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) in the gpon.lua component. Publicly available exploit code exists, though the CVSS:3.1/AV:N/AC:L/PR:H vector indicates attacks require high administrative privileges and deliver limited impact (confidentiality, integrity, availability each L). This is a realistic but constrained threat: exploitation requires authenticated admin-level access to a device already on the network.
Command injection in Tenda CH22 1.0.0.1 via the FormWriteFacMac function allows authenticated remote attackers to execute arbitrary commands by manipulating the mac parameter in the /goform/WriteFacMac endpoint. Publicly available exploit code exists for this vulnerability, which carries a CVSS score of 6.3 and requires low-privilege authentication to trigger.
Unauthenticated attackers can execute arbitrary commands on Tenda F453 routers (version 1.0.0.3) by injecting malicious input through the mac parameter in the /goform/WriteFacMac endpoint. Public exploit code exists for this vulnerability, enabling remote code execution with minimal attack complexity. A patch is not currently available.
OS command injection in Tenda AC8 16.03.50.11 web interface allows authenticated remote attackers to execute arbitrary commands through the wans.policy.list1 parameter in the /cgi-bin/UploadCfg endpoint. Public exploit code exists for this vulnerability and no patch is currently available.
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption and enable remote code execution. [CVSS 7.5 HIGH]
An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. [CVSS 7.5 HIGH]
F3 Firmware contains a vulnerability that allows attackers to the response to be stored in client-side caches and recovered by other local use (CVSS 6.5).
The Tenda F3 Wireless Router firmware lacks CSRF protections in its administrative interface, enabling attackers to trick authenticated administrators into making unauthorized configuration changes through crafted requests. An unauthenticated attacker can exploit this to modify router settings by socially engineering an admin into visiting a malicious webpage. No patch is currently available for this vulnerability.
Tenda F3 Wireless Router firmware V12.01.01.55_multi is vulnerable to reflected cross-site scripting (XSS) in its administrative interface due to missing MIME-sniffing protections and insufficient input validation. An unauthenticated attacker can inject malicious scripts that execute in the context of the admin interface when a user visits a crafted link, potentially leading to administrative account compromise. No patch is currently available for this vulnerability.
Tenda F3 Wireless Router firmware V12.01.01.55_multi lacks clickjacking protections in its web administrative interface, enabling attackers to embed configuration pages in iframes and manipulate authenticated administrators into making unauthorized changes. Public exploit code exists for this vulnerability, affecting administrators who access the router's management interface. While the impact is limited to configuration tampering rather than direct compromise, the lack of available patches leaves affected devices vulnerable.
Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CGI handler. [CVSS 7.5 HIGH]
Stack buffer overflow in Tenda A18 15.13.07.13 firmware allows authenticated remote attackers to execute arbitrary code through malformed boundary parameters in the /cgi-bin/UploadCfg HTTP endpoint. The vulnerability affects the webCgiGetUploadFile function within the Httpd service and has public exploit code available. Affected users should apply patches when available, as the vulnerability requires valid credentials but no user interaction.
Tenda AC21 firmware version 16.03.08.16 contains an information disclosure vulnerability in the /cgi-bin/DownloadFlash web management interface that allows unauthenticated remote attackers to access sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at risk of data exposure.
Tenda AC21 firmware version 16.03.08.16 contains an information disclosure vulnerability in the web management interface's /cgi-bin/DownloadLog endpoint that allows unauthenticated remote attackers to access sensitive data. Public exploit code is available for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected devices.
Tenda AC7 firmware V03.03.03.01_cn and earlier transmits account credentials in cleartext over HTTP, enabling network-positioned attackers to intercept and obtain authentication material without user interaction. This cleartext credential exposure in HTTP responses creates a high confidentiality risk for affected device users. No patch is currently available for this vulnerability.
Tenda AC7 firmware through V03.03.03.01_cn lacks CSRF protections on administrative web functions, enabling attackers to trick authenticated administrators into executing unauthorized configuration changes. An unauthenticated attacker can craft malicious requests that, when visited by an admin, modify router settings without their knowledge or consent. No patch is currently available.
Tenda AC7 firmware v03.03.03.01_cn and earlier transmits administrative credentials in plaintext within web management responses and fails to set proper Cache-Control headers, allowing credentials to be cached by browsers. A local attacker with access to a client system or browser profile can retrieve these cached credentials to gain unauthorized administrative access to affected routers. No patch is currently available for this vulnerability.
The Tenda AC7 firmware web management interface fails to properly sanitize user input, enabling reflected cross-site scripting (XSS) attacks that can inject malicious scripts into a victim's browser. An unauthenticated attacker can exploit this vulnerability to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. No patch is currently available for affected firmware versions V03.03.03.01_cn and earlier.
Command injection in Tenda HG10 firmware allows remote attackers with high privileges to execute arbitrary system commands via the sysCmd parameter in /boaform/formSysCmd. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker can exploit this to achieve limited unauthorized access and potential system compromise.
Command injection in Tenda HG10 firmware's login interface allows unauthenticated remote attackers to execute arbitrary commands by manipulating the Host parameter in the checkUserFromLanOrWan function. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can fully compromise affected devices through remote code execution.
Hg10 Firmware versions up to - contains a vulnerability that allows attackers to command injection (CVSS 7.3).
Command injection in Tenda AC21 firmware versions 1.1.1.1/1.dmzip/16.03.08.16 allows authenticated remote attackers to execute arbitrary commands via the dmzIp parameter in the mDMZSetCfg function. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Tenda W30E firmware versions through V16.01.0.19(5037) omit the X-Content-Type-Options: nosniff header from web management interfaces, enabling MIME type confusion attacks. An unauthenticated remote attacker can exploit this to inject malicious scripts that browsers may execute as legitimate content, potentially compromising the integrity and confidentiality of management traffic. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through version 16.01.0.19(5037) fails to implement proper cache-control headers on sensitive administrative responses, allowing a local authenticated attacker to retrieve cached credentials from the browser's storage. This high-confidentiality impact vulnerability has no available patch and affects users on vulnerable firmware versions.
Tenda W30E firmware through V16.01.0.19(5037) is vulnerable to CORS misconfiguration that permits authenticated administrative endpoints to accept credentialed cross-origin requests from arbitrary origins. An authenticated attacker can exploit this vulnerability to perform unauthorized actions on affected devices by tricking administrators into visiting malicious web pages. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through V16.01.0.19(5037) fails to properly sanitize user input during account creation, allowing authenticated attackers to inject persistent malicious scripts that execute in administrators' browsers when accessing management pages. This stored XSS vulnerability enables session hijacking, credential theft, and unauthorized configuration changes with low complexity exploitation requiring only user interaction from an admin. No patch is currently available for affected devices.
Tenda W30E V2 firmware through V16.01.0.19(5037) lacks CSRF protections on administrative functions, enabling attackers to hijack authenticated admin sessions and modify configuration settings or reset administrator credentials. An attacker can craft malicious requests that execute with the privileges of a logged-in administrator when visited in their browser. No patch is currently available for this vulnerability.
Tenda W30E V2 firmware through V16.01.0.19(5037) exposes stored administrative passwords in plaintext on the management interface, allowing any authenticated user to retrieve credentials. This information disclosure affects administrative account security and could enable privilege escalation or lateral movement. No patch is currently available.
Tenda AX3 firmware has another stack-based buffer overflow in formGetIptv through a different input path, enabling remote code execution.
Tenda AX3 firmware has a third stack-based buffer overflow in formGetIptv, allowing unauthenticated remote code execution through the router's web interface.
Tenda AX3 firmware has a second stack overflow in formSetIptv via the vlanId parameter, allowing remote code execution through the IPTV configuration endpoint.
Tenda AX3 firmware v16.03.12.11 has a stack overflow in formSetIptv via the list parameter, enabling remote attackers to crash the router or execute arbitrary code.
D151 Firmware versions up to - is affected by missing authentication for critical function (CVSS 7.5).
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. [CVSS 7.5 HIGH]
Ac1206 Firmware versions up to 15.03.06.23 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Hard-coded credentials in the shadow file component of multiple Tenda network devices (i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G, TEG5328F) allow local authenticated attackers to gain high-privilege access. Public exploit code is available on GitHub, enabling authentication bypass on devices running firmware versions up to 65.10.15.6. The CWE-259 classification indicates credentials embedded in firmware that cannot be changed through normal configuration. With EPSS data unavailable and no CISA KEV listing, this appears to affect primarily SOHO and small business deployments where local access may be obtained through social engineering or physical access.
OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.
An authenticated heap-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) lets remote attackers corrupt memory through the /goform/setInternetLanInfo handler, potentially achieving high-impact confidentiality, integrity, and availability loss on the device. Exploitation requires network reachability to the device's HTTP management interface and at least low-privilege credentials (CVSS 4.0 vector PR:L), and a public proof-of-concept exploit has been released, raising the practical risk for exposed management UIs. EPSS is 2.88% (86th percentile), indicating elevated but not extreme likelihood of exploitation; there is no CISA KEV listing, so confirmed active exploitation has not been established at time of analysis.
Heap-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) allows an authenticated remote attacker to potentially execute arbitrary code or cause a denial of service by sending oversized values to specific advertising/SMS configuration parameters in the /goform/setAdInfoDetail endpoint. Publicly available exploit code exists for this flaw, though it is not confirmed as actively exploited (no CISA KEV listing). The CVSS 4.0 score is 7.4 (HIGH), and EPSS is 0.74% (53rd percentile).
Stack-based buffer overflow in Tenda M3 firmware 1.0.0.13(4903) allows a remote, low-privileged authenticated attacker to corrupt memory via the mac or terminal parameter of the /goform/setAdPushInfo endpoint handled by formSetAdPushInfo, with high impact to confidentiality, integrity and availability (CVSS 7.4; assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a GitHub write-up is referenced by NVD), but there is no indication of confirmed active exploitation (CISA KEV). Exploitation requires network reachability to the device's HTTP management service plus a valid low-privilege session, so on default deployments the realistic exposure is LAN-side unless remote administration has been enabled.
Stack-based buffer overflow in the Tenda M3 wireless router firmware (build 1.0.0.13(4903)) lets an authenticated attacker who can reach the device's web management interface crash or potentially execute code on the device by sending a single crafted request to the /goform/setVlanInfo endpoint with oversized ID, vlan, or port parameters. Exploitation requires a low-privilege authenticated session (CVSS PR:L) but no user interaction; publicly available exploit code exists (a proof-of-concept writeup is published on GitHub), and the CVSS v4.0 score of 7.4 with an E:P exploit-maturity flag reflects that a working exploit is already circulating, though there is no CISA KEV confirmation of real-world attacks. Devices whose management plane is exposed beyond a trusted LAN/VLAN or that retain default or shared admin credentials are at substantially higher risk.
Heap-based buffer overflow in the web management interface of Tenda M3 firmware 1.0.0.13(4903) allows authenticated attackers to achieve remote code execution or cause a denial of service by sending a crafted request to the /goform/setVlanPolicyData endpoint. The vulnerability has publicly available exploit code, and while the CVSS vector indicates a network attack vector with low privileges required, practical exploitation is limited to attackers who can reach the management interface, typically from the LAN or when remote administration is explicitly enabled. With high impact to confidentiality, integrity, and availability, this flaw poses a serious risk to affected devices.
Denial of service in Tenda CH22 routers (firmware through 1.0.0.1) allows remote unauthenticated attackers to crash the device by sending a crafted request with a manipulated LISTLEN argument to the /goform/DhcpListClient endpoint. Publicly available exploit code exists per the referenced GitHub issue, and no CISA KEV entry has been recorded; EPSS is 4.58% (91st percentile), indicating above-average attention. Impact is confined to availability (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, vendor CVSS 4.0 base 5.5), with no confidentiality or integrity exposure, keeping real-world priority well below a code-execution flaw.
Buffer overflow in Tenda AC10U firmware 15.03.06.48 and 15.03.06.49 through the /goform/AdvSetLanip endpoint's lanMask parameter allows a low-privilege authenticated attacker who can reach the router's web management interface to corrupt memory via a crafted POST request, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. The management interface is typically LAN-bound by default, so realistic exploitation requires local network access or deliberate exposure of the admin UI to the WAN.
Buffer overflow in Tenda AC23 firmware version 16.03.07.52 allows an authenticated remote attacker who can reach the device's HTTP management interface to corrupt memory by submitting a POST request to the formSetPPTPUserList handler with a manipulated 'list' argument, yielding high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 7.4, High). The attack is network-reachable with low complexity and no user interaction, but requires low-level privileges (CVSS PR:L), so it is not a pre-authentication flaw; practical exploitability from the internet depends on whether remote/WAN management is enabled, since the web UI is normally LAN-only. Publicly available exploit code exists, published in a Notion write-up referenced by NVD, though there is no confirmed active exploitation (not in CISA KEV).
An authenticated stack-based buffer overflow in Tenda AC23 firmware 16.03.07.52 allows remote attackers with valid management credentials to trigger memory corruption by sending an oversized bindnum parameter to /goform/SetIpMacBind, potentially enabling arbitrary code execution or a denial-of-service condition. Publicly available exploit code exists, and the independent assessment notes moderately aligned signals toward a real but bounded risk because exploitation requires management-plane access and the device has a low deployment footprint.
Tenda AC10U router firmware versions 15.03.06.48 and 15.03.06.49 contain a buffer overflow (CWE-119) in the formSetPPTPUserList handler for /goform/setPptpUserList, exploitable by sending an oversized 'list' parameter in an HTTP POST request. Successful exploitation can corrupt memory, potentially leading to remote code execution or device crash, with high impact on confidentiality, integrity, and availability. The CVSS vector indicates network attack (AV:N) with low attack complexity and privileges required (PR:L), though the endpoint is often unauthenticated on Tenda devices per independent assessment. Publicly available exploit code exists; no active exploitation in CISA KEV is confirmed. EPSS score is 0.70% (51st percentile).
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an attacker who can reach the device's administrative web service and supply a crafted 'page' argument to the /goform/webExcptypemanFilte endpoint to corrupt stack memory and potentially achieve arbitrary code execution with the privileges of the web server process. Per the vendor-supplied CVSS 4.0 vector (PR:H), the attacker must first hold privileged/authenticated access to the web interface, a requirement that significantly limits real-world exposure, though the endpoint's true pre-authentication reachability should be verified against the firmware. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no indication of confirmed active exploitation in the wild, and no vendor patch or advisory has been identified at time of analysis.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR:H) to execute arbitrary code via the 'page' parameter in the /goform/qossetting endpoint. Publicly available exploit code exists, and the CVSS v4.0 base score is 7.3 (High). Exploitation requires authenticated access to the router's web management interface, which is typically limited to the LAN unless exposed to the internet.
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user crash or potentially execute code on the device by sending an oversized 'page' parameter to the /goform/VirtualSer HTTP handler. The flaw is network-reachable (CVSS:4.0 base 7.3, AV:N/AC:L, PR:H, UI:N), so it requires an administrative session on the web management interface rather than pre-authentication access. Publicly available exploit code exists, including a proof-of-concept with reproduction steps published on GitHub, but there is no CISA KEV entry indicating confirmed in-the-wild exploitation. Successful abuse yields full loss of confidentiality, integrity, and availability on the router itself, though the assessed scope is unchanged (S:U) and no downstream systems are directly impacted.
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote administrator overwrite stack memory through the 'page' argument of the /goform/SetIpBind endpoint, enabling a denial-of-service crash and potentially arbitrary code execution on the device. Exploitation requires valid administrator credentials or an active admin session (CVSS PR:H); no user interaction is needed, and the device is not reachable by anonymous remote attackers in a properly-credentialed default configuration. Publicly available exploit code exists (a detailed BinaryAudit PoC with reproduction steps is published on GitHub), but there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch or fixed firmware version has been identified in the available data.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's HTTP management interface to corrupt memory by submitting an overlong 'page' parameter to /goform/SafeMacFilter, with high confidentiality, integrity, and availability impact if exploitation succeeds. Publicly available exploit code exists, but the attack is gated by the need for a privileged admin session (PR:H) and by LAN-side reachability of the management panel, which is not exposed to the internet by default. The vendor has not published a fixed firmware version in the available data, so risk is moderate rather than top-tier.
Stack-based buffer overflow in the Tenda WH450 router running firmware 1.0.0.18 lets an authenticated administrator crash or potentially execute code on the device by sending an oversized 'page' argument to the /goform/SafeEmailFilter handler, which is reachable remotely over the web management interface. Publicly available exploit code exists (a BinaryAudit PoC on GitHub) and the CVSS v4.0 base score is 7.3 with PR:H, confirming that a privileged session is a prerequisite; there is no evidence of confirmed active exploitation (not in CISA KEV). Impact is bounded to the device itself - no scope change to downstream systems - but the high integrity and availability sub-scores mean a successful attack can fully compromise the router's configuration. Risk is real but contained: the main gating factor is obtaining admin credentials (default or weak passwords on SOHO routers materially ease this), and exposure of the management UI to untrusted networks.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated administrator to corrupt memory and potentially execute arbitrary code by sending a crafted HTTP request to the /goform/RouteStatic endpoint with an oversized 'page' argument. Exploitation requires high-privilege credentials (CVSS PR:H) and network reachability to the router's management interface, which on SOHO devices is typically LAN-side rather than exposed to the WAN. Publicly available exploit code exists (a GitHub proof-of-concept walkthrough of the RouteStatic overflow), so the barrier to reproduction is low for anyone who already has admin access; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.