25
CVEs
13
Critical
7
High
0
KEV
15
PoC
20
Unpatched C/H
0.0%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
13
HIGH
7
MEDIUM
1
LOW
4
Monthly CVE Trend
Affected Products (30)
Ac6 Firmware
117
Ac18 Firmware
112
Ac9 Firmware
98
Ac15 Firmware
97
Ac10 Firmware
87
Ac7 Firmware
64
Fh1202 Firmware
63
Ax1806 Firmware
61
W30e Firmware
61
Ac8 Firmware
59
Ax1803 Firmware
58
N A
58
Ac1206 Firmware
43
Fh1206 Firmware
38
Ac10U Firmware
38
M3 Firmware
37
Fh1201 Firmware
36
Ac5 Firmware
35
Fh1203 Firmware
35
F1203 Firmware
34
W15e Firmware
31
G3 Firmware
31
Fh1205 Firmware
29
Ax3 Firmware
27
Ac21 Firmware
26
Ax12 Firmware
25
F1202 Firmware
25
F453 Firmware
24
Ac23 Firmware
22
W20e Firmware
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86148 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the flaw is remotely reachable. | CRITICAL | 9.4 | 2.5% | 69 |
PoC
No patch
|
| CVE-2026-86151 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets an attacker inject shell commands through the function sub_2F77E8 in Apis/system.c, part of the Network Configuration Management component. Successful exploitation yields arbitrary command execution on the camera's embedded Linux OS. The CVSS 4.0 vector requires high privileges (PR:H), and no public exploit or active exploitation has been identified at time of analysis. | CRITICAL | 9.4 | 2.0% | 69 |
PoC
No patch
|
| CVE-2026-82542 | Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2026-82693 | Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function. | CRITICAL | 9.3 | 0.8% | 66 |
PoC
No patch
|
| CVE-2026-82694 | Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-82695 | Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC. | CRITICAL | 9.3 | 0.7% | 66 |
PoC
No patch
|
| CVE-2026-86165 | Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing. | HIGH | 8.9 | 0.6% | 65 |
PoC
No patch
|
| CVE-2026-86167 | OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-85109 | Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists. | HIGH | 8.9 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-86166 | Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-85110 | Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-86152 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell commands via the CAutoAddWifi::ThreadProc function of the Kylin component's AutoAddWifi.cpp. The flaw is reachable without authentication over the network and yields full device compromise. No public exploit has been identified at time of analysis, and the report originates from a single source (VulDB). | CRITICAL | 10.0 | 1.9% | 52 |
No patch
|
| CVE-2026-51934 | Remote code execution in the Tenda A18 Wi-Fi router (firmware v15.13.07.09) arises from an unauthenticated buffer overflow in the fromSetCmdlineRun function, letting a remote attacker corrupt memory and run arbitrary code on the device. The CVSS 9.8 vector indicates network-reachable, no-authentication, no-interaction exploitation, and a public repository (github.com/momo8877847/Tenda-A18) appears to document the flaw, so publicly available exploit code likely exists. There is no CISA KEV listing and EPSS is low (0.30%), indicating no confirmed widespread active exploitation at this time. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-67966 | Unauthenticated remote root access affects the Tenda W20E router (firmware V16.01.0.6(2782)) through its /goform/telnet web endpoint, which activates the device's Telnet daemon without any authentication check. Any attacker who can reach the router's management interface can enable Telnet and log in for a root shell, giving full control of the device. A public disclosure/PoC repository exists, though the flaw is not listed in CISA KEV and EPSS-modeled exploitation probability is currently low (0.19%). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-67967 | Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|