262
CVEs
33
Critical
192
High
0
KEV
151
PoC
224
Unpatched C/H
0.4%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
33
HIGH
192
MEDIUM
18
LOW
19
Monthly CVE Trend
Affected Products (30)
Ac6 Firmware
117
Ac18 Firmware
112
Ac9 Firmware
98
Ac15 Firmware
97
Ac10 Firmware
87
Ac7 Firmware
64
Fh1202 Firmware
63
Ax1806 Firmware
61
W30e Firmware
61
Ac8 Firmware
59
Ax1803 Firmware
58
N A
58
Ac1206 Firmware
43
Fh1206 Firmware
38
Ac10U Firmware
38
M3 Firmware
37
Fh1201 Firmware
36
Ac5 Firmware
35
Fh1203 Firmware
35
F1203 Firmware
34
W15e Firmware
31
G3 Firmware
31
Fh1205 Firmware
29
Ax3 Firmware
27
Ac21 Firmware
26
Ax12 Firmware
25
F1202 Firmware
25
F453 Firmware
24
Ac23 Firmware
22
W20e Firmware
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86148 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the flaw is remotely reachable. | CRITICAL | 9.4 | 2.5% | 69 |
PoC
No patch
|
| CVE-2026-86151 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets an attacker inject shell commands through the function sub_2F77E8 in Apis/system.c, part of the Network Configuration Management component. Successful exploitation yields arbitrary command execution on the camera's embedded Linux OS. The CVSS 4.0 vector requires high privileges (PR:H), and no public exploit or active exploitation has been identified at time of analysis. | CRITICAL | 9.4 | 2.0% | 69 |
PoC
No patch
|
| CVE-2026-82542 | Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2018-25316 | Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.3 | 0.0% | 67 |
PoC
No patch
|
| CVE-2018-25317 | Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.3 | 0.0% | 67 |
PoC
No patch
|
| CVE-2018-25318 | Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.3 | 0.0% | 67 |
PoC
No patch
|
| CVE-2026-82693 | Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function. | CRITICAL | 9.3 | 0.8% | 66 |
PoC
No patch
|
| CVE-2026-82694 | Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-82695 | Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-19924 | Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumvent the httpd web management interface's access controls via manipulation of the R7WebsSecurityHandler function. The vulnerability carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit has been published on GitHub, materially lowering the exploitation barrier and enabling opportunistic mass-targeting of exposed devices. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-86165 | Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing. | HIGH | 8.9 | 0.6% | 65 |
PoC
No patch
|
| CVE-2026-86167 | OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-4567 | Stack-based buffer overflow in Tenda A15 router firmware version 15.13.07.13 allows unauthenticated remote attackers to achieve complete system compromise through a malicious file upload to the UploadCfg function. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network with trivial complexity. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-85109 | Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists. | HIGH | 8.9 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-19750 | Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices. | HIGH | 8.2 | 0.5% | 61 |
PoC
No patch
|