Tenda M3 Firmware
45 CVEs affecting Tenda M3 Firmware. Latest disclosed: 2026-04-05. Critical: 17, High: 28.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51094 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet. |
CVE-2023-51093 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo. |
CVE-2023-51092 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. |
CVE-2023-51091 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler. |
CVE-2023-51090 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig. |
CVE-2023-51095 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy. |
CVE-2022-27083 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. |
CVE-2022-27082 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. |
CVE-2022-27081 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. |
CVE-2022-27080 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. |
CVE-2022-27079 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. |
CVE-2022-27078 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. |
CVE-2022-27077 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
CVE-2022-27076 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
CVE-2022-26536 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
CVE-2022-26290 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. |
CVE-2022-26289 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. |
CVE-2026-5567 | High | 8.8 | 2026-04-05 | A flaw has been found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Dest… |
CVE-2025-15253 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the… |
CVE-2025-15252 | High | 8.8 | 2025-12-30 | A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation… |