Tenda
Monthly
A stack-based buffer overflow in the Tenda WH450 router (firmware version 1.0.0.18) can be triggered by sending a crafted 'delno' argument to the /goform/PPTPUserSetting configuration endpoint, allowing memory corruption that can be leveraged for code execution or denial of service. Exploitation requires authenticated administrative access to the device's web management interface, since the vulnerable handler is a privileged configuration endpoint (CVSS PR:H), though the attack itself is network-reachable with no user interaction. Publicly available exploit code exists in a GitHub proof-of-concept, and no vendor-released patch has been identified at time of analysis; the affected scope is limited to this specific firmware version, so risk concentrates on devices with exposed or default-credentialed management interfaces.
Stack-based buffer overflow in Tenda WH450 firmware version 1.0.0.18 allows an attacker with administrative access to the router's web management interface to achieve remote code execution by sending an overlong 'ip1' parameter to the /goform/PPTPServer endpoint. The vulnerability requires high privileges (CVSS PR:H) but no user interaction, and publicly available exploit code exists, making it a realistic risk when the admin panel is exposed to untrusted networks or default credentials are used. The CVSS 4.0 score is 7.3, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
Remote command injection in Tenda WH450 firmware 1.0.0.18 allows unauthenticated command execution via the ipaddress parameter in the /goform/CheckTools HTTP endpoint. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is low (0.25%).
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corrupt memory through an oversized Username parameter, with assessed high impact on confidentiality, integrity, and availability. Exploitation requires reachability to the router’s web-management interface, which is typically LAN-bound, and the assessed vector indicates no authentication or user interaction is required. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory, crash the device, and potentially execute code by sending a crafted netmsk value to the /goform/PPTPClient HTTP endpoint; the CVSS 4.0 vector scores 8.9 with no privileges or user interaction required. Publicly available exploit code exists in a GitHub BinaryAudit proof-of-concept, so the flaw is easy to reproduce, though real-world exposure depends on whether the router's management interface is reachable from the attacker's network. Practical exploitation is often limited because SOHO router web management is commonly bound to the LAN interface unless remote/WAN management has been enabled.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory via a crafted request to the /goform/Natlimit endpoint, specifically by manipulating the 'page' argument. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so any party able to reach the router's web management interface can attempt exploitation. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no CISA KEV confirmation of active exploitation; EPSS is 1.08% (65th percentile), and real-world risk is bounded by exposure, since SOHO routers typically restrict this interface to the LAN unless WAN-side remote management is enabled or port forwarding exposes it.
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to corrupt memory and potentially hijack execution flow by sending a crafted request to /goform/NatStaticSetting with an oversized 'page' argument (CVSS 4.0 base 8.9; independent assessment CVSS 3.1 9.8-equivalent vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact to the device). Publicly available exploit code exists in the z472421519/BinaryAudit repository, including a reproduce walkthrough, but there is no CISA KEV listing, so active exploitation is not confirmed. EPSS is 1.08% (65th percentile) - modest but non-trivial for an internet-exposed SOHO device - and the practical risk is gated by exposure, since the WH450 management interface is typically LAN-facing and only reachable from the WAN if remote web administration has been enabled or the device is port-forwarded.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory on the device by sending a crafted 'page' parameter to the /goform/SafeUrlFilter endpoint, with high impact to confidentiality, integrity and availability per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists, but EPSS estimates only a 1.00% chance of exploitation in the next 30 days (62nd percentile) and no CISA KEV listing indicates confirmed active exploitation. Signals are mixed: the technical severity is high, yet the practical attack surface is limited because the HTTP management interface on default SOHO deployments is LAN-facing, so a real-world attacker generally needs local-network adjacency unless WAN-side remote management has been enabled.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to achieve limited confidentiality, integrity, and availability impacts via the /goform/L7Port endpoint. Public exploit code is available (EPSS 0.11%), but no active exploitation has been reported. The vulnerability, though network-accessible without authentication, is constrained in its real-world impact.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' parameter. Per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials, special configuration, or user interaction are required, and publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), though CISA KEV does not list this issue as actively exploited. EPSS places exploitation likelihood at roughly 1.00% (62nd percentile), reflecting that the practical exposure depends on whether the router's web management interface is reachable by the attacker, since SOHO devices of this class typically restrict administration to the LAN by default.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially achieve arbitrary code execution on the device by sending a crafted HTTP request to the /goform/CheckTools endpoint with an oversized 'ipaddress' argument. The CVSS:4.0 vector (8.9, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) indicates the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction, so any device with an exposed management interface is directly at risk. Publicly available exploit code exists (a GitHub PoC walkthrough with reproduction steps), while EPSS is modest at 0.97% (61st percentile) and there is no CISA KEV entry, meaning no confirmed active exploitation at time of analysis.
Stack-based buffer overflow in the Tenda FH1201 SOHO router running firmware 1.2.0.14(408) lets an authenticated remote attacker corrupt memory by sending an oversized 'page' parameter to the /goform/SetIpBind endpoint, which is passed unsafely into sprintf. Successful exploitation can yield full loss of confidentiality, integrity, and availability on the device (assessed CVSS 3.1 base 8.8-style impact, vendor/VulDB score 7.4), though the attacker must first reach the web management interface, which is normally LAN-bound, and hold a low-privilege authenticated session (PR:L). Publicly available exploit code exists (a GitHub PoC with reproduction steps), so weaponization is straightforward for anyone who can obtain panel access; there is no CISA KEV listing, so active exploitation is not confirmed from the supplied data.
Remote stack-based buffer overflow in the Tenda FH1201 and FH1206 SOHO router firmware (FH1201 1.2.0.14(408) and FH1206 1.2.0.8(8155)) allows an attacker who can reach the web management interface to corrupt the stack by sending a crafted HTTP request to /goform/webtypelibrary with an overlong webSiteId argument, writing past the bounds of a fixed-size stack buffer inside a strcat call. Successful corruption gives high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 7.4, assessed CVSS 3.1 8.8), and the CVSS 4.0 vector specifies PR:L - authenticated (low-privilege) access to the management interface - with no user interaction required; exploitation additionally depends on network reachability to the HTTP management interface, which on default deployments is LAN-side rather than WAN-side. Publicly available exploit code exists (two GitHub write-ups covering both FH1201 and FH1206), and EPSS is low at 0.75% (54th percentile); there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Stack-based buffer overflow in Tenda AC18 firmware 15.03.05.05 allows an authenticated low-privilege attacker with HTTP access to the router management interface to corrupt memory by sending an overlong 'mac' value to /goform/GetParentControlInfo. Publicly available exploit code exists with reproduction steps, but no CISA KEV active-exploitation confirmation is provided; EPSS is 0.74% (54th percentile). The assessed impact is high for confidentiality, integrity, and availability, with the main practical constraint being reachability of the management UI and the PR:L authentication requirement.
A stack-based buffer overflow in the httpd binary of Tenda AC10 V4.0 firmware 16.03.10.20 allows adjacent network attackers to crash the device's web management service and potentially achieve code execution by sending a crafted POST request to /goform/AdvSetMacMtuWan with an overlong serverName field. No authentication is required (CVSS PR:N), but exploitation is constrained to the same local network segment (AV:A) and to the specific vulnerable build. Publicly available exploit code exists; the confirmed impact is denial of service (crash of httpd), while code execution has not been verified, and EPSS is low at 0.38% (30th percentile).
Unauthenticated remote attackers can trigger a buffer overflow in the Tenda AC10 v4.0 router's HTTP daemon (bin/httpd) by sending a crafted POST request to /goform/AdvSetMacMtuWan, leading to denial of service and potentially remote code execution. The flaw (CVE-2025-67073, CVSS 9.8, CWE-120) affects firmware V16.03.10.20, and publicly available exploit code exists; however, real-world exploitation requires network reachability to the router's administrative interface, which by default is restricted to the LAN unless WAN remote management is enabled. The confirmed impact is denial of service, while code execution remains conditional on memory layout and exploitability.
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
Weak cryptographic hashing in the image_check function of Tenda AX9 firmware 22.03.01.46 allows remote attackers to compromise firmware integrity validation without authentication. The vulnerability has a CVSS score of 2.9 (very low severity) and publicly available exploit code exists, but the high attack complexity and difficult exploitability rating indicate practical barriers to successful exploitation. Real-world risk is minimal: while the vulnerability permits information disclosure related to hash values, it does not enable remote code execution or device takeover.
A stack-based buffer overflow in the Tenda CH22 router's HTTP management service (firmware 1.0.0.1) lets an attacker crash or potentially execute code on the device by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' argument handled by the frmL7ImForm function. The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but per the assessed CVSS 4.0 vector it requires low-privilege authentication (PR:L), so the attacker must either hold valid credentials or reach a handler that is exposed pre-authentication - a constraint worth verifying, since many Tenda /goform handlers are reachable without login. Publicly available exploit code exists (published via a GitHub issue tracked in the NVD references), the EPSS score is 0.76% (54th percentile) indicating modest but non-trivial exploitation likelihood, and there is no CISA KEV listing, so active exploitation in the wild is not confirmed by the available data. Successful exploitation yields high confidentiality, integrity, and availability impact on the router itself, with no assessed impact to downstream connected systems.
Unauthenticated information disclosure in Tenda AC9 firmware 15.03.05.14_multi allows remote attackers to retrieve the router's configuration backup through the /cgi-bin/DownloadCfg.jpg endpoint of the Configuration File Handler without supplying credentials or requiring user interaction. Publicly available exploit code exists, but EPSS estimates observed exploitation likelihood at only about 0.68% (51st percentile), and practical exposure is constrained because AC9 management interfaces are normally reachable from the LAN only unless remote/WAN administration has been enabled. Impact is confidentiality-only (CVSS 3.1 5.5, C:L) with no effect on integrity or availability; if configuration data is obtained it typically contains Wi-Fi passphrases, admin credentials, and WAN/DDNS settings.
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC10 16.03.10.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Tenda A15 15.13.07.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Tenda AC8 16.03.34.06. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
Authenticated remote attackers can exploit a buffer overflow in Tenda CH22 router firmware version 1.0.0.1 to potentially execute arbitrary code by manipulating the 'page' parameter in the /goform/NatStaticSetting endpoint. The vulnerability requires valid credentials to the web management interface and network reachability, with low attack complexity and no user interaction. Publicly available exploit code exists, but no active exploitation has been confirmed.
A buffer overflow in the Tenda CH22 router web management interface (firmware 1.0.0.1) lets a network-adjacent attacker who holds low-privilege credentials corrupt memory by sending a crafted 'page' parameter to the /goform/P2pListFilter endpoint, which is handled by the fromP2pListFilter function, potentially leading to code execution or device crash. The flaw is not confirmed as actively exploited (no CISA KEV listing), but publicly available exploit code exists and demonstrates the attack, so unpatched, internet- or LAN-exposed management interfaces should be treated as at risk. EPSS is low (0.71%, ~52nd percentile), and the independent assessment rates the issue a moderate priority given the authentication prerequisite and the typically LAN-limited reachability of the management endpoint.
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticated session on the device's HTTP management interface to manipulate the 'page' argument of the /goform/webExcptypemanFilter endpoint and overflow the buffer handled by fromwebExcptypemanFilter, achieving high impact on confidentiality, integrity, and availability. The issue is remotely reachable (CVSS 4.0 base 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction, so exploitation is reliable once access is obtained. Publicly available exploit code exists (a public PoC is linked from the reporting references), but there is no confirmed active exploitation (CISA KEV), and EPSS is moderate at 1.01% (62nd percentile), indicating elevated but not top-tier risk.
An authenticated buffer overflow in the Tenda CH22 router's web management service (firmware 1.0.0.1) lets an attacker who can reach and log in to the device's HTTP interface corrupt memory via the 'page' argument to the /goform/addressNat handler, with the potential for code execution or denial of service. Publicly available exploit code exists (a PoC is published on GitHub), though exploitation requires network reachability to the admin interface and the low-privilege authentication implied by the PR:L vector; no CISA KEV entry confirms active exploitation, and EPSS is low at roughly 0.75% (54th percentile). Exposure is confined to CH22 firmware 1.0.0.1, and because the web UI is normally LAN-bound, real-world risk is moderate unless remote administration has been exposed to the WAN.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 lets an authenticated remote attacker corrupt memory in the fromRouteStatic handler of the /goform/RouteStatic web endpoint by submitting an oversized 'page' argument, yielding high impact to the device's confidentiality, integrity, and availability (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit code is publicly available (a GitHub PoC linked from the NVD entry), but there is no confirmation of active exploitation - the CVE is not in CISA KEV - and EPSS is only about 1.01% (62nd percentile), so predicted exploitation activity is moderate. Successful abuse requires a valid low-privilege web-UI session per the PR:L metric plus network reachability to the management interface, which on this SOHO router is LAN-side by default and only internet-reachable if the admin panel has been exposed to the WAN.
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interface via the /goform/VirtualSer endpoint's fromVirtualSer function, leading to high impact on confidentiality, integrity, and availability. The vulnerability requires valid management credentials (PR:L) and network access to the device's web interface, but is low-complexity and needs no user interaction. Publicly available exploit code exists, though EPSS is only 1.04% (63rd percentile), indicating moderate exploitation likelihood; no active exploitation has been confirmed in CISA KEV.
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code on the device by sending a crafted 'page' argument to the fromDhcpListClient handler reached through the /goform/DhcpListClient web endpoint. Per the assigned CVSS vector (PR:L), exploitation requires a low-privilege authenticated session on the web management interface, so the practical attack surface is limited to parties who can reach that interface (typically LAN-side, or WAN-side if remote management is enabled) and who hold valid credentials. Publicly available exploit code exists (a proof-of-concept linked from the advisory), and EPSS sits at 3.49% (89th percentile), indicating elevated relative interest, though there is no confirmed active exploitation (not in CISA KEV). The independent assessment rates the overall risk as moderate but credible, driven by the authentication prerequisite and the narrow affected firmware version rather than by confirmed in-the-wild activity.
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interface to corrupt memory by supplying an oversized 'page' argument to /goform/SafeMacFilter, potentially enabling arbitrary code execution or denial of service. Exploitation requires low-privilege authentication (CVSS PR:L) and network reachability to the device's admin panel, which is typically restricted to the LAN side. Publicly available exploit code exists; no vendor patch has been identified at time of analysis, and no active exploitation in the wild has been confirmed.
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or potentially execute code on the device by sending a crafted request to the /goform/SafeUrlFilter endpoint with an oversized 'page' argument processed by the fromSafeUrlFilter handler. Per the supplied CVSS vector (PR:L), exploitation requires a low-privilege authenticated session against the router's HTTP management interface, and no user interaction is needed; this authentication prerequisite is the primary limiting factor, and devices whose management interface is not reachable from the attacker's network segment are not exposed. Publicly available exploit code exists (referenced in a public GitHub issue), and EPSS estimates a 4.71% probability of exploitation activity (92nd percentile), though there is no CISA KEV confirmation of active exploitation and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to the router's web management interface to corrupt memory via the page parameter in /goform/SafeClientFilter, potentially leading to code execution or denial of service. Exploitation requires network reachability to the management interface and, on typical deployments, is limited to LAN-side access unless remote WAN management is enabled. Publicly available exploit code exists (GitHub QIU-DIE/CVE issue #13), but there is no confirmed active exploitation (CISA KEV), and EPSS is 4.92% (92nd percentile).
Stack-based buffer overflow in the HTTP request handler of Tenda AC6 firmware 15.03.06.50 allows an attacker to corrupt memory and achieve high-integrity/high-availability impact by supplying an oversized value in the shareSpeed argument to the /goform/WifiGuestSet endpoint, which handles Wi-Fi guest network configuration. The vulnerability is remotely triggerable over the network but, per the CVSS vector (PR:L), requires authentication to the router's web management interface, so practical exploitation depends on either LAN access to the admin panel or possession of valid/default credentials. Publicly available exploit code exists (a GitHub proof-of-concept walkthrough) and EPSS is 1.03% (63rd percentile); there is no CISA KEV listing, so no confirmed active exploitation in the wild, and no vendor-released patch version is identified in the available data.
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipulating the 'enable' parameter of the /goform/sysAutoReboot endpoint. Exploitation requires valid low-privilege web credentials (PR:L), but no user interaction, and publicly available exploit code exists. The EPSS score is low (0.8%), suggesting limited real-world exploitation, but the impact is high (full confidentiality, integrity, and availability loss on the device if exploited).
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated access to the device management interface to corrupt memory via an overlong 'lan' parameter submitted to the /goform/setVlanConfig endpoint, potentially achieving arbitrary code execution or a denial of service. The issue is confined to a single legacy firmware build of this outdoor bridge/CPE device, and exploitation requires the web management service to be network-reachable plus valid low-privilege credentials (CVSS 4.0 PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a detailed PoC write-up is published on GitHub), but there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.80% (55th percentile), so real-world risk is moderate and concentrated in deployments where the admin interface is exposed.
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmware 1.0.0.10(2478) lets an authenticated low-privilege attacker who can reach the device's web management interface overwrite stack memory by sending an oversized upnpEn argument, yielding complete loss of confidentiality, integrity, and availability on the device itself (assessed CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, including a GitHub proof-of-concept and a VULDB submission, but the issue is not listed in CISA KEV and EPSS is 0.80% (55th percentile), so active exploitation is not confirmed. Because the CVSS vector specifies PR:L, a valid low-privilege session or working credentials are needed rather than fully anonymous access, and the management interface must be network-reachable.
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with low-privilege web-interface credentials to corrupt memory, and potentially execute code or crash the device, by sending an overlong dmzIP parameter to the /goform/setDmzInfo endpoint. Publicly available exploit code exists (referenced GitHub PoC), though the CVE is not in CISA KEV and EPSS is 0.84% (56th percentile), indicating a real but not top-tier priority. Reachability is constrained because exploitation requires access to the router's HTTP management interface, typically LAN-side unless remote management is explicitly enabled, and authentication is required per the assessed CVSS vector (PR:L).
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers corrupt stack memory through a crafted lanIp value submitted to the /goform/AdvSetLanip web endpoint, potentially achieving code execution or forcing a device crash/reboot. Exploitation requires network reachability to the router's HTTP management interface and, per the CVSS PR:L metric, valid credentials; the flaw is not pre-authentication. Publicly available proof-of-concept exploit code exists (E:P in the CVSS v4.0 vector, plus a GitHub write-up), and EPSS sits at roughly 1.08% (64th percentile), indicating moderate but not elevated real-world targeting; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged, authenticated remote attacker corrupt memory via a crafted dhcpEn parameter sent to /goform/setDhcpConfig, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicating high confidentiality, integrity and availability impact. The critical limiting factor is the PR:L requirement: the attacker must first reach the device's web management plane and hold valid low-privilege credentials or a session, so real-world exposure depends on whether the admin interface is reachable beyond the LAN (for example via enabled remote management or WAN-side access) and whether default or weak credentials remain in place. Publicly available exploit code exists and the EPSS score of 1.03% (63rd percentile) places it in the moderate-priority band; there is no CISA KEV confirmation of active exploitation, and no vendor-released patch has been identified at time of analysis.
Hard-coded credentials in Tenda RP3 Pro firmware (versions up to 22.5.7.93) allow local high-privilege attackers to bypass authentication during firmware updates via the force_upgrade.sh script. Public exploit code exists on GitHub. CVSS 7.0 (High) reflects local access requirement with high privileges, making this a lower real-world priority despite the severity rating - exploitation requires an attacker to already have administrative console access to the device.
Stack-based buffer overflow in Tenda AC7 router firmware version 15.03.06.44 allows a remote attacker to corrupt memory through the newVersion argument of the /goform/setNotUpgrade HTTP endpoint, potentially achieving code execution with full loss of confidentiality, integrity, and availability of the device. Both the supplied CVSS 4.0 vector and our independent assessment carry PR:L, meaning the request must originate from a session holding valid web-UI credentials - in practice an attacker on the LAN/management segment or anyone holding valid admin credentials, not a default unauthenticated WAN attacker. Publicly available exploit code exists (a detailed PoC is published in the noahze01/IoT-vulnerable GitHub repository), but there is no KEV listing confirming active exploitation, and the EPSS score of 0.87% (57th percentile) indicates modest near-term exploitation likelihood; no vendor-released patch was identified in the available data.
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HTTP request handler. A remote attacker with low-privilege credentials can trigger the flaw to disrupt router availability. Public exploit code exists, but active exploitation has not been confirmed (CISA KEV absent) and the EPSS score (0.09%) suggests a low probability of widespread exploitation.
Stack-based buffer overflow in Tenda W12 firmware version 3.0.0.6(3948) allows an authenticated remote attacker to crash or potentially execute code on the device by sending an overlong 'mac' argument to the wifiMacFilterSet function exposed through the /goform/modules HTTP endpoint. Exploitation requires valid low-privilege credentials or a session on the router's web management interface (CVSS PR:L), which in practice means LAN-side access unless remote management is exposed to the WAN; no user interaction is needed and attack complexity is low. Publicly available exploit code exists (a GitHub PoC with a binary-audit write-up), EPSS is 8.48% (95th percentile) indicating elevated real-world attention, but there is no KEV entry confirming active exploitation, and the flaw is confined to this single firmware build.
Stack-based buffer overflow in the Tenda AC7 router firmware (version 15.03.06.44) lets an attacker who can reach the web management interface crash or potentially execute code on the device by sending a crafted 'enable' parameter to the /goform/saveAutoQos endpoint. Per the assessed CVSS vector (PR:L), exploitation requires low-privilege authenticated access to that interface, meaning valid or default credentials are a prerequisite, and reachability is normally limited to the LAN unless WAN/remote management is enabled. Publicly available exploit code exists and EPSS places the vulnerability in the 55th percentile (0.80%), a moderate-priority issue whose real-world risk is tempered by its access requirements; it is not confirmed as actively exploited (no CISA KEV listing).
Stack-based buffer overflow in Tenda AC7 firmware 15.03.06.44 lets an authenticated remote attacker crash or potentially execute code on the device by sending an overlong 'Password' value to the /goform/fast_setting_pppoe_set (PPPoE quick-setup) HTTP endpoint. The flaw carries a CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N, high C/I/A impact, no scope change), and per the supplied vector the attacker needs a low-privilege session (PR:L) rather than being unauthenticated. Publicly available exploit code exists (a PoC write-up is linked from the NVD references), but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.80% (roughly the 55th percentile), indicating moderate-but-not-elevated predicted exploitation likelihood.
Stack-based buffer overflow in the Tenda AC7 router (firmware 15.03.06.44) lets a network-reachable, authenticated attacker corrupt memory and potentially execute code by sending an oversized wifi_chkHz value to the /goform/WifiMacFilterSet handler. Exploitation requires a valid low-privilege session on the web management interface (CVSS PR:L) and no user interaction (UI:N); publicly available exploit code exists for this exact firmware, though there is no evidence of active exploitation (not in CISA KEV). EPSS is low at roughly 0.80% (55th percentile), and overall the signal set is moderate and internally consistent rather than alarming, with real-world exposure largely limited to devices whose management interface is reachable and whose remote-management option is enabled.
Authenticated attackers who can reach the Tenda AC7 router's web management interface can trigger a stack-based buffer overflow by submitting an oversized upnpEn argument to the /goform/SetUpnpCfg configuration endpoint on firmware 15.03.06.44, corrupting a fixed-size stack buffer and yielding high impact across confidentiality, integrity, and availability. Publicly available exploit code exists (a public PoC write-up documents the trigger), and EPSS stands at 1.03% (63rd percentile), but there is no CISA KEV listing - no confirmed active exploitation at time of analysis. Because the HTTP management interface is LAN-side by default and the attack requires a low-privilege authenticated session, internet-wide exploitation is limited unless remote administration has been enabled or the management port is exposed.
Stack-based buffer overflow in Tenda AC7 firmware 15.03.06.44 allows an attacker who can reach the router's web management interface and invoke the /goform/SetDDNSCfg handler with a crafted ddnsEn parameter to overwrite stack memory, with the potential for arbitrary code execution with full confidentiality, integrity, and availability impact or, at minimum, a device crash. Per the CVSS vector (PR:L), authentication to the management interface is required, and publicly available exploit code exists (E:P), though the flaw is not listed in CISA KEV and EPSS remains modest at 1.03% (63rd percentile). Practical reachability depends on exposure of the management interface, which on SOHO routers is normally limited to the LAN unless remote/WAN management has been enabled.
Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a crafted request to the /goform/SafeEmailFilter endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 base score is 8.9, reflecting high impact to confidentiality, integrity, and availability; EPSS is 0.86% (low likelihood).
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
Remote attackers with low-privilege credentials on the Tenda AC15 web management interface can trigger a stack-based buffer overflow by manipulating the 'enable' argument of the /goform/saveAutoQos endpoint, corrupting memory and potentially achieving code execution or causing a device crash; the confirmed affected build is firmware 15.03.05.18. Publicly available exploit code exists (per the linked GitHub proof-of-concept and VulDB submissions), and no CISA KEV entry confirms active exploitation, though the CVSS 4.0 vector carries an E:P (proof-of-concept) exploit maturity flag. Our independent assessment rates this a moderate, not top-tier, priority: exploitation requires valid low-privilege credentials (PR:L) and network reachability to the router's web UI, so real-world risk spikes only when that interface is internet-facing or protected by default/weak credentials.
Stack-based buffer overflow in the Tenda AC15 router firmware (version 15.03.05.18) lets network-reachable attackers corrupt memory on the device by sending an oversized 'newVersion' value to the /goform/setNotUpgrade HTTP endpoint, achieving full loss of confidentiality, integrity, and availability on the device. The attack vector is network-based with low complexity and no user interaction, but the CVSS 4.0 vector (PR:L) and independent assessment both indicate that valid low-privilege credentials for the web management interface are required, meaning the management UI must be network-reachable - typically only severe when exposed to the WAN/internet. Exploit code is publicly available (linked from the NVD references) and the assessment notes it 'might be used'; no CISA KEV entry or confirmed in-the-wild exploitation was reported at the time of analysis.
Stack-based buffer overflow in Tenda AC15 firmware 15.03.05.18 allows authenticated, low-privileged remote attackers to execute arbitrary code via the 'Password' parameter of the /goform/fast_setting_pppoe_set endpoint. Publicly available exploit code exists; no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 score is 7.4, and exploitation requires network access to the device's management interface and valid credentials.
Stack-based buffer overflow in Tenda AC15 firmware version 15.03.05.18 allows remote attackers with low-privilege authentication to potentially execute arbitrary code by sending a crafted POST request to the /goform/SetDDNSCfg endpoint, manipulating the ddnsEn parameter. The vulnerability requires network access to the router's HTTP management interface and valid low-level credentials; no user interaction is needed. Publicly available exploit code exists, increasing the risk of exploitation, though there is no confirmed active exploitation at this time. The assessed severity is high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Buffer overflow in the Tenda AC20 router firmware (up to and including 16.03.08.12) lets remote attackers corrupt memory via the timeZone parameter of the /goform/fast_setting_wifi_set web endpoint, with high confidentiality, integrity, and availability impact. Per the CVSS 4.0 vector the attack requires low-privilege authentication (PR:L) and no user interaction, although the same class of Tenda /goform setup handlers has historically been reachable without credentials, so the auth requirement is worth verifying. Publicly available exploit code exists for this flaw, but there is no confirmation of active exploitation; the main practical barrier is that the web management interface is normally LAN-only, so internet-facing exploitation depends on the device being exposed to a network segment an attacker controls.
Buffer overflow in Tenda AC23 firmware up to 16.03.07.52 enables authenticated remote attackers with access to the web management interface to execute arbitrary code or crash the device by sending an overly long 'list' parameter to the /goform/SetStaticRouteCfg endpoint. The vulnerability is network-reachable with low attack complexity (CVSS 7.4 High) and requires low privileges (PR:L), typically achievable via default or weak credentials. Publicly available exploit code exists.
Stack-based buffer overflow in the Tenda AC18 router web management interface (firmware 15.03.05.19(6318)) lets an authenticated attacker corrupt memory by sending an oversized ddnsEn parameter to the /goform/SetDDNSCfg endpoint, with high confidentiality, integrity, and availability impact on the device. The CVSS 4.0 base score is 7.4, and our independent CVSS 3.1 assessment rates it 8.8, with the low-privilege session requirement (PR:L) and network reachability to the management interface being the primary limiting factors; no user interaction is needed. Publicly available exploit code exists via a GitHub proof-of-concept and EPSS estimates a 1.07% (64th percentile) probability of exploitation activity, while there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Authenticated low-privilege attackers can trigger a stack-based buffer overflow in Tenda AC18 firmware 15.03.05.19(6318) by sending an overlong upnpEn argument to the /goform/SetUpnpCfg endpoint, potentially achieving full confidentiality, integrity, and availability impact on the router. Exploitation requires reaching the HTTP management interface with valid low-privilege credentials, which on SOHO devices often means default or weak admin credentials, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) is reported; EPSS is low at 1.24% (68th percentile), so the overall signal is moderate and narrows realistic remote exploitation to exposed management interfaces.
A stack-based buffer overflow in the Tenda WH450 router (firmware version 1.0.0.18) can be triggered by sending a crafted 'delno' argument to the /goform/PPTPUserSetting configuration endpoint, allowing memory corruption that can be leveraged for code execution or denial of service. Exploitation requires authenticated administrative access to the device's web management interface, since the vulnerable handler is a privileged configuration endpoint (CVSS PR:H), though the attack itself is network-reachable with no user interaction. Publicly available exploit code exists in a GitHub proof-of-concept, and no vendor-released patch has been identified at time of analysis; the affected scope is limited to this specific firmware version, so risk concentrates on devices with exposed or default-credentialed management interfaces.
Stack-based buffer overflow in Tenda WH450 firmware version 1.0.0.18 allows an attacker with administrative access to the router's web management interface to achieve remote code execution by sending an overlong 'ip1' parameter to the /goform/PPTPServer endpoint. The vulnerability requires high privileges (CVSS PR:H) but no user interaction, and publicly available exploit code exists, making it a realistic risk when the admin panel is exposed to untrusted networks or default credentials are used. The CVSS 4.0 score is 7.3, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
Remote command injection in Tenda WH450 firmware 1.0.0.18 allows unauthenticated command execution via the ipaddress parameter in the /goform/CheckTools HTTP endpoint. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is low (0.25%).
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corrupt memory through an oversized Username parameter, with assessed high impact on confidentiality, integrity, and availability. Exploitation requires reachability to the router’s web-management interface, which is typically LAN-bound, and the assessed vector indicates no authentication or user interaction is required. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory, crash the device, and potentially execute code by sending a crafted netmsk value to the /goform/PPTPClient HTTP endpoint; the CVSS 4.0 vector scores 8.9 with no privileges or user interaction required. Publicly available exploit code exists in a GitHub BinaryAudit proof-of-concept, so the flaw is easy to reproduce, though real-world exposure depends on whether the router's management interface is reachable from the attacker's network. Practical exploitation is often limited because SOHO router web management is commonly bound to the LAN interface unless remote/WAN management has been enabled.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory via a crafted request to the /goform/Natlimit endpoint, specifically by manipulating the 'page' argument. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so any party able to reach the router's web management interface can attempt exploitation. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no CISA KEV confirmation of active exploitation; EPSS is 1.08% (65th percentile), and real-world risk is bounded by exposure, since SOHO routers typically restrict this interface to the LAN unless WAN-side remote management is enabled or port forwarding exposes it.
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to corrupt memory and potentially hijack execution flow by sending a crafted request to /goform/NatStaticSetting with an oversized 'page' argument (CVSS 4.0 base 8.9; independent assessment CVSS 3.1 9.8-equivalent vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact to the device). Publicly available exploit code exists in the z472421519/BinaryAudit repository, including a reproduce walkthrough, but there is no CISA KEV listing, so active exploitation is not confirmed. EPSS is 1.08% (65th percentile) - modest but non-trivial for an internet-exposed SOHO device - and the practical risk is gated by exposure, since the WH450 management interface is typically LAN-facing and only reachable from the WAN if remote web administration has been enabled or the device is port-forwarded.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory on the device by sending a crafted 'page' parameter to the /goform/SafeUrlFilter endpoint, with high impact to confidentiality, integrity and availability per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists, but EPSS estimates only a 1.00% chance of exploitation in the next 30 days (62nd percentile) and no CISA KEV listing indicates confirmed active exploitation. Signals are mixed: the technical severity is high, yet the practical attack surface is limited because the HTTP management interface on default SOHO deployments is LAN-facing, so a real-world attacker generally needs local-network adjacency unless WAN-side remote management has been enabled.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to achieve limited confidentiality, integrity, and availability impacts via the /goform/L7Port endpoint. Public exploit code is available (EPSS 0.11%), but no active exploitation has been reported. The vulnerability, though network-accessible without authentication, is constrained in its real-world impact.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' parameter. Per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials, special configuration, or user interaction are required, and publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), though CISA KEV does not list this issue as actively exploited. EPSS places exploitation likelihood at roughly 1.00% (62nd percentile), reflecting that the practical exposure depends on whether the router's web management interface is reachable by the attacker, since SOHO devices of this class typically restrict administration to the LAN by default.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially achieve arbitrary code execution on the device by sending a crafted HTTP request to the /goform/CheckTools endpoint with an oversized 'ipaddress' argument. The CVSS:4.0 vector (8.9, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) indicates the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction, so any device with an exposed management interface is directly at risk. Publicly available exploit code exists (a GitHub PoC walkthrough with reproduction steps), while EPSS is modest at 0.97% (61st percentile) and there is no CISA KEV entry, meaning no confirmed active exploitation at time of analysis.
Stack-based buffer overflow in the Tenda FH1201 SOHO router running firmware 1.2.0.14(408) lets an authenticated remote attacker corrupt memory by sending an oversized 'page' parameter to the /goform/SetIpBind endpoint, which is passed unsafely into sprintf. Successful exploitation can yield full loss of confidentiality, integrity, and availability on the device (assessed CVSS 3.1 base 8.8-style impact, vendor/VulDB score 7.4), though the attacker must first reach the web management interface, which is normally LAN-bound, and hold a low-privilege authenticated session (PR:L). Publicly available exploit code exists (a GitHub PoC with reproduction steps), so weaponization is straightforward for anyone who can obtain panel access; there is no CISA KEV listing, so active exploitation is not confirmed from the supplied data.
Remote stack-based buffer overflow in the Tenda FH1201 and FH1206 SOHO router firmware (FH1201 1.2.0.14(408) and FH1206 1.2.0.8(8155)) allows an attacker who can reach the web management interface to corrupt the stack by sending a crafted HTTP request to /goform/webtypelibrary with an overlong webSiteId argument, writing past the bounds of a fixed-size stack buffer inside a strcat call. Successful corruption gives high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 7.4, assessed CVSS 3.1 8.8), and the CVSS 4.0 vector specifies PR:L - authenticated (low-privilege) access to the management interface - with no user interaction required; exploitation additionally depends on network reachability to the HTTP management interface, which on default deployments is LAN-side rather than WAN-side. Publicly available exploit code exists (two GitHub write-ups covering both FH1201 and FH1206), and EPSS is low at 0.75% (54th percentile); there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Stack-based buffer overflow in Tenda AC18 firmware 15.03.05.05 allows an authenticated low-privilege attacker with HTTP access to the router management interface to corrupt memory by sending an overlong 'mac' value to /goform/GetParentControlInfo. Publicly available exploit code exists with reproduction steps, but no CISA KEV active-exploitation confirmation is provided; EPSS is 0.74% (54th percentile). The assessed impact is high for confidentiality, integrity, and availability, with the main practical constraint being reachability of the management UI and the PR:L authentication requirement.
A stack-based buffer overflow in the httpd binary of Tenda AC10 V4.0 firmware 16.03.10.20 allows adjacent network attackers to crash the device's web management service and potentially achieve code execution by sending a crafted POST request to /goform/AdvSetMacMtuWan with an overlong serverName field. No authentication is required (CVSS PR:N), but exploitation is constrained to the same local network segment (AV:A) and to the specific vulnerable build. Publicly available exploit code exists; the confirmed impact is denial of service (crash of httpd), while code execution has not been verified, and EPSS is low at 0.38% (30th percentile).
Unauthenticated remote attackers can trigger a buffer overflow in the Tenda AC10 v4.0 router's HTTP daemon (bin/httpd) by sending a crafted POST request to /goform/AdvSetMacMtuWan, leading to denial of service and potentially remote code execution. The flaw (CVE-2025-67073, CVSS 9.8, CWE-120) affects firmware V16.03.10.20, and publicly available exploit code exists; however, real-world exploitation requires network reachability to the router's administrative interface, which by default is restricted to the LAN unless WAN remote management is enabled. The confirmed impact is denial of service, while code execution remains conditional on memory layout and exploitability.
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
Weak cryptographic hashing in the image_check function of Tenda AX9 firmware 22.03.01.46 allows remote attackers to compromise firmware integrity validation without authentication. The vulnerability has a CVSS score of 2.9 (very low severity) and publicly available exploit code exists, but the high attack complexity and difficult exploitability rating indicate practical barriers to successful exploitation. Real-world risk is minimal: while the vulnerability permits information disclosure related to hash values, it does not enable remote code execution or device takeover.
A stack-based buffer overflow in the Tenda CH22 router's HTTP management service (firmware 1.0.0.1) lets an attacker crash or potentially execute code on the device by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' argument handled by the frmL7ImForm function. The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but per the assessed CVSS 4.0 vector it requires low-privilege authentication (PR:L), so the attacker must either hold valid credentials or reach a handler that is exposed pre-authentication - a constraint worth verifying, since many Tenda /goform handlers are reachable without login. Publicly available exploit code exists (published via a GitHub issue tracked in the NVD references), the EPSS score is 0.76% (54th percentile) indicating modest but non-trivial exploitation likelihood, and there is no CISA KEV listing, so active exploitation in the wild is not confirmed by the available data. Successful exploitation yields high confidentiality, integrity, and availability impact on the router itself, with no assessed impact to downstream connected systems.
Unauthenticated information disclosure in Tenda AC9 firmware 15.03.05.14_multi allows remote attackers to retrieve the router's configuration backup through the /cgi-bin/DownloadCfg.jpg endpoint of the Configuration File Handler without supplying credentials or requiring user interaction. Publicly available exploit code exists, but EPSS estimates observed exploitation likelihood at only about 0.68% (51st percentile), and practical exposure is constrained because AC9 management interfaces are normally reachable from the LAN only unless remote/WAN administration has been enabled. Impact is confidentiality-only (CVSS 3.1 5.5, C:L) with no effect on integrity or availability; if configuration data is obtained it typically contains Wi-Fi passphrases, admin credentials, and WAN/DDNS settings.
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC10 16.03.10.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Tenda A15 15.13.07.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Tenda AC8 16.03.34.06. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
Authenticated remote attackers can exploit a buffer overflow in Tenda CH22 router firmware version 1.0.0.1 to potentially execute arbitrary code by manipulating the 'page' parameter in the /goform/NatStaticSetting endpoint. The vulnerability requires valid credentials to the web management interface and network reachability, with low attack complexity and no user interaction. Publicly available exploit code exists, but no active exploitation has been confirmed.
A buffer overflow in the Tenda CH22 router web management interface (firmware 1.0.0.1) lets a network-adjacent attacker who holds low-privilege credentials corrupt memory by sending a crafted 'page' parameter to the /goform/P2pListFilter endpoint, which is handled by the fromP2pListFilter function, potentially leading to code execution or device crash. The flaw is not confirmed as actively exploited (no CISA KEV listing), but publicly available exploit code exists and demonstrates the attack, so unpatched, internet- or LAN-exposed management interfaces should be treated as at risk. EPSS is low (0.71%, ~52nd percentile), and the independent assessment rates the issue a moderate priority given the authentication prerequisite and the typically LAN-limited reachability of the management endpoint.
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticated session on the device's HTTP management interface to manipulate the 'page' argument of the /goform/webExcptypemanFilter endpoint and overflow the buffer handled by fromwebExcptypemanFilter, achieving high impact on confidentiality, integrity, and availability. The issue is remotely reachable (CVSS 4.0 base 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction, so exploitation is reliable once access is obtained. Publicly available exploit code exists (a public PoC is linked from the reporting references), but there is no confirmed active exploitation (CISA KEV), and EPSS is moderate at 1.01% (62nd percentile), indicating elevated but not top-tier risk.
An authenticated buffer overflow in the Tenda CH22 router's web management service (firmware 1.0.0.1) lets an attacker who can reach and log in to the device's HTTP interface corrupt memory via the 'page' argument to the /goform/addressNat handler, with the potential for code execution or denial of service. Publicly available exploit code exists (a PoC is published on GitHub), though exploitation requires network reachability to the admin interface and the low-privilege authentication implied by the PR:L vector; no CISA KEV entry confirms active exploitation, and EPSS is low at roughly 0.75% (54th percentile). Exposure is confined to CH22 firmware 1.0.0.1, and because the web UI is normally LAN-bound, real-world risk is moderate unless remote administration has been exposed to the WAN.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 lets an authenticated remote attacker corrupt memory in the fromRouteStatic handler of the /goform/RouteStatic web endpoint by submitting an oversized 'page' argument, yielding high impact to the device's confidentiality, integrity, and availability (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit code is publicly available (a GitHub PoC linked from the NVD entry), but there is no confirmation of active exploitation - the CVE is not in CISA KEV - and EPSS is only about 1.01% (62nd percentile), so predicted exploitation activity is moderate. Successful abuse requires a valid low-privilege web-UI session per the PR:L metric plus network reachability to the management interface, which on this SOHO router is LAN-side by default and only internet-reachable if the admin panel has been exposed to the WAN.
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interface via the /goform/VirtualSer endpoint's fromVirtualSer function, leading to high impact on confidentiality, integrity, and availability. The vulnerability requires valid management credentials (PR:L) and network access to the device's web interface, but is low-complexity and needs no user interaction. Publicly available exploit code exists, though EPSS is only 1.04% (63rd percentile), indicating moderate exploitation likelihood; no active exploitation has been confirmed in CISA KEV.
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code on the device by sending a crafted 'page' argument to the fromDhcpListClient handler reached through the /goform/DhcpListClient web endpoint. Per the assigned CVSS vector (PR:L), exploitation requires a low-privilege authenticated session on the web management interface, so the practical attack surface is limited to parties who can reach that interface (typically LAN-side, or WAN-side if remote management is enabled) and who hold valid credentials. Publicly available exploit code exists (a proof-of-concept linked from the advisory), and EPSS sits at 3.49% (89th percentile), indicating elevated relative interest, though there is no confirmed active exploitation (not in CISA KEV). The independent assessment rates the overall risk as moderate but credible, driven by the authentication prerequisite and the narrow affected firmware version rather than by confirmed in-the-wild activity.
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interface to corrupt memory by supplying an oversized 'page' argument to /goform/SafeMacFilter, potentially enabling arbitrary code execution or denial of service. Exploitation requires low-privilege authentication (CVSS PR:L) and network reachability to the device's admin panel, which is typically restricted to the LAN side. Publicly available exploit code exists; no vendor patch has been identified at time of analysis, and no active exploitation in the wild has been confirmed.
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or potentially execute code on the device by sending a crafted request to the /goform/SafeUrlFilter endpoint with an oversized 'page' argument processed by the fromSafeUrlFilter handler. Per the supplied CVSS vector (PR:L), exploitation requires a low-privilege authenticated session against the router's HTTP management interface, and no user interaction is needed; this authentication prerequisite is the primary limiting factor, and devices whose management interface is not reachable from the attacker's network segment are not exposed. Publicly available exploit code exists (referenced in a public GitHub issue), and EPSS estimates a 4.71% probability of exploitation activity (92nd percentile), though there is no CISA KEV confirmation of active exploitation and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to the router's web management interface to corrupt memory via the page parameter in /goform/SafeClientFilter, potentially leading to code execution or denial of service. Exploitation requires network reachability to the management interface and, on typical deployments, is limited to LAN-side access unless remote WAN management is enabled. Publicly available exploit code exists (GitHub QIU-DIE/CVE issue #13), but there is no confirmed active exploitation (CISA KEV), and EPSS is 4.92% (92nd percentile).
Stack-based buffer overflow in the HTTP request handler of Tenda AC6 firmware 15.03.06.50 allows an attacker to corrupt memory and achieve high-integrity/high-availability impact by supplying an oversized value in the shareSpeed argument to the /goform/WifiGuestSet endpoint, which handles Wi-Fi guest network configuration. The vulnerability is remotely triggerable over the network but, per the CVSS vector (PR:L), requires authentication to the router's web management interface, so practical exploitation depends on either LAN access to the admin panel or possession of valid/default credentials. Publicly available exploit code exists (a GitHub proof-of-concept walkthrough) and EPSS is 1.03% (63rd percentile); there is no CISA KEV listing, so no confirmed active exploitation in the wild, and no vendor-released patch version is identified in the available data.
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipulating the 'enable' parameter of the /goform/sysAutoReboot endpoint. Exploitation requires valid low-privilege web credentials (PR:L), but no user interaction, and publicly available exploit code exists. The EPSS score is low (0.8%), suggesting limited real-world exploitation, but the impact is high (full confidentiality, integrity, and availability loss on the device if exploited).
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated access to the device management interface to corrupt memory via an overlong 'lan' parameter submitted to the /goform/setVlanConfig endpoint, potentially achieving arbitrary code execution or a denial of service. The issue is confined to a single legacy firmware build of this outdoor bridge/CPE device, and exploitation requires the web management service to be network-reachable plus valid low-privilege credentials (CVSS 4.0 PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a detailed PoC write-up is published on GitHub), but there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.80% (55th percentile), so real-world risk is moderate and concentrated in deployments where the admin interface is exposed.
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmware 1.0.0.10(2478) lets an authenticated low-privilege attacker who can reach the device's web management interface overwrite stack memory by sending an oversized upnpEn argument, yielding complete loss of confidentiality, integrity, and availability on the device itself (assessed CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, including a GitHub proof-of-concept and a VULDB submission, but the issue is not listed in CISA KEV and EPSS is 0.80% (55th percentile), so active exploitation is not confirmed. Because the CVSS vector specifies PR:L, a valid low-privilege session or working credentials are needed rather than fully anonymous access, and the management interface must be network-reachable.
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with low-privilege web-interface credentials to corrupt memory, and potentially execute code or crash the device, by sending an overlong dmzIP parameter to the /goform/setDmzInfo endpoint. Publicly available exploit code exists (referenced GitHub PoC), though the CVE is not in CISA KEV and EPSS is 0.84% (56th percentile), indicating a real but not top-tier priority. Reachability is constrained because exploitation requires access to the router's HTTP management interface, typically LAN-side unless remote management is explicitly enabled, and authentication is required per the assessed CVSS vector (PR:L).
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers corrupt stack memory through a crafted lanIp value submitted to the /goform/AdvSetLanip web endpoint, potentially achieving code execution or forcing a device crash/reboot. Exploitation requires network reachability to the router's HTTP management interface and, per the CVSS PR:L metric, valid credentials; the flaw is not pre-authentication. Publicly available proof-of-concept exploit code exists (E:P in the CVSS v4.0 vector, plus a GitHub write-up), and EPSS sits at roughly 1.08% (64th percentile), indicating moderate but not elevated real-world targeting; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged, authenticated remote attacker corrupt memory via a crafted dhcpEn parameter sent to /goform/setDhcpConfig, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicating high confidentiality, integrity and availability impact. The critical limiting factor is the PR:L requirement: the attacker must first reach the device's web management plane and hold valid low-privilege credentials or a session, so real-world exposure depends on whether the admin interface is reachable beyond the LAN (for example via enabled remote management or WAN-side access) and whether default or weak credentials remain in place. Publicly available exploit code exists and the EPSS score of 1.03% (63rd percentile) places it in the moderate-priority band; there is no CISA KEV confirmation of active exploitation, and no vendor-released patch has been identified at time of analysis.
Hard-coded credentials in Tenda RP3 Pro firmware (versions up to 22.5.7.93) allow local high-privilege attackers to bypass authentication during firmware updates via the force_upgrade.sh script. Public exploit code exists on GitHub. CVSS 7.0 (High) reflects local access requirement with high privileges, making this a lower real-world priority despite the severity rating - exploitation requires an attacker to already have administrative console access to the device.
Stack-based buffer overflow in Tenda AC7 router firmware version 15.03.06.44 allows a remote attacker to corrupt memory through the newVersion argument of the /goform/setNotUpgrade HTTP endpoint, potentially achieving code execution with full loss of confidentiality, integrity, and availability of the device. Both the supplied CVSS 4.0 vector and our independent assessment carry PR:L, meaning the request must originate from a session holding valid web-UI credentials - in practice an attacker on the LAN/management segment or anyone holding valid admin credentials, not a default unauthenticated WAN attacker. Publicly available exploit code exists (a detailed PoC is published in the noahze01/IoT-vulnerable GitHub repository), but there is no KEV listing confirming active exploitation, and the EPSS score of 0.87% (57th percentile) indicates modest near-term exploitation likelihood; no vendor-released patch was identified in the available data.
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HTTP request handler. A remote attacker with low-privilege credentials can trigger the flaw to disrupt router availability. Public exploit code exists, but active exploitation has not been confirmed (CISA KEV absent) and the EPSS score (0.09%) suggests a low probability of widespread exploitation.
Stack-based buffer overflow in Tenda W12 firmware version 3.0.0.6(3948) allows an authenticated remote attacker to crash or potentially execute code on the device by sending an overlong 'mac' argument to the wifiMacFilterSet function exposed through the /goform/modules HTTP endpoint. Exploitation requires valid low-privilege credentials or a session on the router's web management interface (CVSS PR:L), which in practice means LAN-side access unless remote management is exposed to the WAN; no user interaction is needed and attack complexity is low. Publicly available exploit code exists (a GitHub PoC with a binary-audit write-up), EPSS is 8.48% (95th percentile) indicating elevated real-world attention, but there is no KEV entry confirming active exploitation, and the flaw is confined to this single firmware build.
Stack-based buffer overflow in the Tenda AC7 router firmware (version 15.03.06.44) lets an attacker who can reach the web management interface crash or potentially execute code on the device by sending a crafted 'enable' parameter to the /goform/saveAutoQos endpoint. Per the assessed CVSS vector (PR:L), exploitation requires low-privilege authenticated access to that interface, meaning valid or default credentials are a prerequisite, and reachability is normally limited to the LAN unless WAN/remote management is enabled. Publicly available exploit code exists and EPSS places the vulnerability in the 55th percentile (0.80%), a moderate-priority issue whose real-world risk is tempered by its access requirements; it is not confirmed as actively exploited (no CISA KEV listing).
Stack-based buffer overflow in Tenda AC7 firmware 15.03.06.44 lets an authenticated remote attacker crash or potentially execute code on the device by sending an overlong 'Password' value to the /goform/fast_setting_pppoe_set (PPPoE quick-setup) HTTP endpoint. The flaw carries a CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N, high C/I/A impact, no scope change), and per the supplied vector the attacker needs a low-privilege session (PR:L) rather than being unauthenticated. Publicly available exploit code exists (a PoC write-up is linked from the NVD references), but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.80% (roughly the 55th percentile), indicating moderate-but-not-elevated predicted exploitation likelihood.
Stack-based buffer overflow in the Tenda AC7 router (firmware 15.03.06.44) lets a network-reachable, authenticated attacker corrupt memory and potentially execute code by sending an oversized wifi_chkHz value to the /goform/WifiMacFilterSet handler. Exploitation requires a valid low-privilege session on the web management interface (CVSS PR:L) and no user interaction (UI:N); publicly available exploit code exists for this exact firmware, though there is no evidence of active exploitation (not in CISA KEV). EPSS is low at roughly 0.80% (55th percentile), and overall the signal set is moderate and internally consistent rather than alarming, with real-world exposure largely limited to devices whose management interface is reachable and whose remote-management option is enabled.
Authenticated attackers who can reach the Tenda AC7 router's web management interface can trigger a stack-based buffer overflow by submitting an oversized upnpEn argument to the /goform/SetUpnpCfg configuration endpoint on firmware 15.03.06.44, corrupting a fixed-size stack buffer and yielding high impact across confidentiality, integrity, and availability. Publicly available exploit code exists (a public PoC write-up documents the trigger), and EPSS stands at 1.03% (63rd percentile), but there is no CISA KEV listing - no confirmed active exploitation at time of analysis. Because the HTTP management interface is LAN-side by default and the attack requires a low-privilege authenticated session, internet-wide exploitation is limited unless remote administration has been enabled or the management port is exposed.
Stack-based buffer overflow in Tenda AC7 firmware 15.03.06.44 allows an attacker who can reach the router's web management interface and invoke the /goform/SetDDNSCfg handler with a crafted ddnsEn parameter to overwrite stack memory, with the potential for arbitrary code execution with full confidentiality, integrity, and availability impact or, at minimum, a device crash. Per the CVSS vector (PR:L), authentication to the management interface is required, and publicly available exploit code exists (E:P), though the flaw is not listed in CISA KEV and EPSS remains modest at 1.03% (63rd percentile). Practical reachability depends on exposure of the management interface, which on SOHO routers is normally limited to the LAN unless remote/WAN management has been enabled.
Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a crafted request to the /goform/SafeEmailFilter endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 base score is 8.9, reflecting high impact to confidentiality, integrity, and availability; EPSS is 0.86% (low likelihood).
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
Remote attackers with low-privilege credentials on the Tenda AC15 web management interface can trigger a stack-based buffer overflow by manipulating the 'enable' argument of the /goform/saveAutoQos endpoint, corrupting memory and potentially achieving code execution or causing a device crash; the confirmed affected build is firmware 15.03.05.18. Publicly available exploit code exists (per the linked GitHub proof-of-concept and VulDB submissions), and no CISA KEV entry confirms active exploitation, though the CVSS 4.0 vector carries an E:P (proof-of-concept) exploit maturity flag. Our independent assessment rates this a moderate, not top-tier, priority: exploitation requires valid low-privilege credentials (PR:L) and network reachability to the router's web UI, so real-world risk spikes only when that interface is internet-facing or protected by default/weak credentials.
Stack-based buffer overflow in the Tenda AC15 router firmware (version 15.03.05.18) lets network-reachable attackers corrupt memory on the device by sending an oversized 'newVersion' value to the /goform/setNotUpgrade HTTP endpoint, achieving full loss of confidentiality, integrity, and availability on the device. The attack vector is network-based with low complexity and no user interaction, but the CVSS 4.0 vector (PR:L) and independent assessment both indicate that valid low-privilege credentials for the web management interface are required, meaning the management UI must be network-reachable - typically only severe when exposed to the WAN/internet. Exploit code is publicly available (linked from the NVD references) and the assessment notes it 'might be used'; no CISA KEV entry or confirmed in-the-wild exploitation was reported at the time of analysis.
Stack-based buffer overflow in Tenda AC15 firmware 15.03.05.18 allows authenticated, low-privileged remote attackers to execute arbitrary code via the 'Password' parameter of the /goform/fast_setting_pppoe_set endpoint. Publicly available exploit code exists; no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 score is 7.4, and exploitation requires network access to the device's management interface and valid credentials.
Stack-based buffer overflow in Tenda AC15 firmware version 15.03.05.18 allows remote attackers with low-privilege authentication to potentially execute arbitrary code by sending a crafted POST request to the /goform/SetDDNSCfg endpoint, manipulating the ddnsEn parameter. The vulnerability requires network access to the router's HTTP management interface and valid low-level credentials; no user interaction is needed. Publicly available exploit code exists, increasing the risk of exploitation, though there is no confirmed active exploitation at this time. The assessed severity is high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Buffer overflow in the Tenda AC20 router firmware (up to and including 16.03.08.12) lets remote attackers corrupt memory via the timeZone parameter of the /goform/fast_setting_wifi_set web endpoint, with high confidentiality, integrity, and availability impact. Per the CVSS 4.0 vector the attack requires low-privilege authentication (PR:L) and no user interaction, although the same class of Tenda /goform setup handlers has historically been reachable without credentials, so the auth requirement is worth verifying. Publicly available exploit code exists for this flaw, but there is no confirmation of active exploitation; the main practical barrier is that the web management interface is normally LAN-only, so internet-facing exploitation depends on the device being exposed to a network segment an attacker controls.
Buffer overflow in Tenda AC23 firmware up to 16.03.07.52 enables authenticated remote attackers with access to the web management interface to execute arbitrary code or crash the device by sending an overly long 'list' parameter to the /goform/SetStaticRouteCfg endpoint. The vulnerability is network-reachable with low attack complexity (CVSS 7.4 High) and requires low privileges (PR:L), typically achievable via default or weak credentials. Publicly available exploit code exists.
Stack-based buffer overflow in the Tenda AC18 router web management interface (firmware 15.03.05.19(6318)) lets an authenticated attacker corrupt memory by sending an oversized ddnsEn parameter to the /goform/SetDDNSCfg endpoint, with high confidentiality, integrity, and availability impact on the device. The CVSS 4.0 base score is 7.4, and our independent CVSS 3.1 assessment rates it 8.8, with the low-privilege session requirement (PR:L) and network reachability to the management interface being the primary limiting factors; no user interaction is needed. Publicly available exploit code exists via a GitHub proof-of-concept and EPSS estimates a 1.07% (64th percentile) probability of exploitation activity, while there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Authenticated low-privilege attackers can trigger a stack-based buffer overflow in Tenda AC18 firmware 15.03.05.19(6318) by sending an overlong upnpEn argument to the /goform/SetUpnpCfg endpoint, potentially achieving full confidentiality, integrity, and availability impact on the router. Exploitation requires reaching the HTTP management interface with valid low-privilege credentials, which on SOHO devices often means default or weak admin credentials, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) is reported; EPSS is low at 1.24% (68th percentile), so the overall signal is moderate and narrows realistic remote exploitation to exposed management interfaces.