69
CVEs
20
Critical
40
High
0
KEV
36
PoC
60
Unpatched C/H
0.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
20
HIGH
40
MEDIUM
3
LOW
6
Monthly CVE Trend
Affected Products (30)
Ac6 Firmware
117
Ac18 Firmware
112
Ac9 Firmware
98
Ac15 Firmware
97
Ac10 Firmware
87
Ac7 Firmware
64
Fh1202 Firmware
63
Ax1806 Firmware
61
W30e Firmware
61
Ac8 Firmware
59
Ax1803 Firmware
58
N A
58
Ac1206 Firmware
43
Fh1206 Firmware
38
Ac10U Firmware
38
M3 Firmware
37
Fh1201 Firmware
36
Ac5 Firmware
35
Fh1203 Firmware
35
F1203 Firmware
34
W15e Firmware
31
G3 Firmware
31
Fh1205 Firmware
29
Ax3 Firmware
27
Ac21 Firmware
26
Ax12 Firmware
25
F1202 Firmware
25
F453 Firmware
24
Ac23 Firmware
22
W20e Firmware
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86148 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the flaw is remotely reachable. | CRITICAL | 9.4 | 2.5% | 69 |
PoC
No patch
|
| CVE-2026-86151 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets an attacker inject shell commands through the function sub_2F77E8 in Apis/system.c, part of the Network Configuration Management component. Successful exploitation yields arbitrary command execution on the camera's embedded Linux OS. The CVSS 4.0 vector requires high privileges (PR:H), and no public exploit or active exploitation has been identified at time of analysis. | CRITICAL | 9.4 | 2.0% | 69 |
PoC
No patch
|
| CVE-2026-82542 | Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2026-82693 | Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function. | CRITICAL | 9.3 | 0.8% | 66 |
PoC
No patch
|
| CVE-2026-82694 | Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-82695 | Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-19924 | Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumvent the httpd web management interface's access controls via manipulation of the R7WebsSecurityHandler function. The vulnerability carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit has been published on GitHub, materially lowering the exploitation barrier and enabling opportunistic mass-targeting of exposed devices. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-86165 | Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing. | HIGH | 8.9 | 0.6% | 65 |
PoC
No patch
|
| CVE-2026-86167 | OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-85109 | Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists. | HIGH | 8.9 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-19750 | Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices. | HIGH | 8.2 | 0.5% | 61 |
PoC
No patch
|
| CVE-2026-15695 | Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack by supplying an oversized 'page' argument to the /goform/DhcpListClient web endpoint handled by the fromDhcpListClient function. The flaw is reachable over the network and publicly available exploit code exists (disclosed via VulDB), though it is not listed in CISA KEV and no EPSS score was provided. Per the supplied CVSS 4.0 vector (PR:L) the attack requires low-level authentication to the device, and successful exploitation can crash the router or potentially achieve arbitrary code execution. | HIGH | 7.4 | 0.8% | 58 |
PoC
No patch
|
| CVE-2026-86166 | Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-13517 | Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) allows remote attackers to corrupt memory by manipulating the security_5g argument sent to the formWifiBasicSet handler at /goform/WifiBasicSet, potentially achieving denial of service or arbitrary code execution on the device. The flaw is network-reachable but, per the CVSS 4.0 vector, requires low-level authentication (PR:L), and publicly available exploit code exists. There is no public exploit identified as actively exploited in CISA KEV, and the EPSS score was not provided. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-13518 | Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote attacker corrupt memory by manipulating the 'page' parameter handled by the fromAddressNat function at the /goform/addressNat endpoint, potentially achieving code execution or device crash. Publicly available exploit code exists and the issue was disclosed by VulDB, though there is no public exploit identified as actively exploited in the wild. With a CVSS 4.0 base score of 7.4 and PR:L, exploitation requires some level of authenticated access to the web management interface. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|