481
CVEs
55
Critical
347
High
0
KEV
322
PoC
401
Unpatched C/H
0.2%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
55
HIGH
347
MEDIUM
51
LOW
28
Monthly CVE Trend
Affected Products (30)
Ac6 Firmware
117
Ac18 Firmware
112
Ac9 Firmware
98
Ac15 Firmware
97
Ac10 Firmware
87
Ac7 Firmware
64
Fh1202 Firmware
63
Ax1806 Firmware
61
W30e Firmware
61
Ac8 Firmware
59
Ax1803 Firmware
58
N A
58
Ac1206 Firmware
43
Fh1206 Firmware
38
Ac10U Firmware
38
M3 Firmware
37
Fh1201 Firmware
36
Ac5 Firmware
35
Fh1203 Firmware
35
F1203 Firmware
34
W15e Firmware
31
G3 Firmware
31
Fh1205 Firmware
29
Ax3 Firmware
27
Ac21 Firmware
26
Ax12 Firmware
25
F1202 Firmware
25
F453 Firmware
24
Ac23 Firmware
22
W20e Firmware
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-24105 | Tenda AC15 router has a code injection in formsetUsbUnload (EPSS 1.7%) enabling unauthenticated remote code execution. | CRITICAL | 9.8 | 1.7% | 71 |
PoC
No patch
|
| CVE-2026-24107 | Tenda W20E router has a code injection vulnerability in usbPartitionName parameter allowing unauthenticated remote code execution with EPSS 1.1%. | CRITICAL | 9.8 | 1.1% | 70 |
PoC
No patch
|
| CVE-2026-24101 | Tenda AC15 router has a command injection in formSetIptv (EPSS 1.1%) enabling unauthenticated root-level code execution. | CRITICAL | 9.8 | 1.1% | 70 |
PoC
No patch
|
| CVE-2026-86148 | OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the flaw is remotely reachable. | CRITICAL | 9.4 | 2.5% | 69 |
PoC
No patch
|
| CVE-2025-69762 | Tenda AX3 firmware v16.03.12.11 has a stack overflow in formSetIptv via the list parameter, enabling remote attackers to crash the router or execute arbitrary code. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
No patch
|
| CVE-2025-69763 | Tenda AX3 firmware has a second stack overflow in formSetIptv via the vlanId parameter, allowing remote code execution through the IPTV configuration endpoint. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
No patch
|
| CVE-2025-69766 | Tenda AX3 firmware has a third stack-based buffer overflow in formGetIptv, allowing unauthenticated remote code execution through the router's web interface. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
No patch
|
| CVE-2025-69764 | Tenda AX3 firmware has another stack-based buffer overflow in formGetIptv through a different input path, enabling remote code execution. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24108 | Tenda W20E has a buffer overflow — second of eight critical vulnerabilities in this router firmware. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24109 | Tenda W20E has a third buffer overflow in a different CGI parameter. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24111 | Tenda W20E has a fourth buffer overflow vulnerability. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24113 | Tenda W20E has a fifth buffer overflow. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24114 | Tenda W20E has a sixth buffer overflow in pPortMapIndex parameter validation. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24115 | Tenda W20E has a seventh buffer overflow in gstup parameter handling. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-24110 | Tenda W20E has an eighth buffer overflow in addDhcpRules parameter. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|