Tenda
Page 4 of 8 — Tenda CVEs from a corpus of 766, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24435 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticat… |
CVE-2026-24433 | Medium | 5.4 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functio… |
CVE-2026-24432 | Medium | 4.3 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints… |
CVE-2026-24431 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web… |
CVE-2026-24430 | High | 7.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses genera… |
CVE-2026-24429 | Critical | 9.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account th… |
CVE-2026-24428 | High | 8.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privi… |
CVE-2026-1420 | High | 8.8 | 2026-01-26 | A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_cr… |
CVE-2025-69764 | Critical | 9.8 | 2026-01-22 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which… |
CVE-2026-1329 | High | 8.8 | 2026-01-22 | A flaw has been found in Tenda AX1803 1.0.0.1. The affected element is the function fromGetWifiGuestBasic of the file /goform/WifiGuestSet. Executing a manipul… |
CVE-2025-69766 | Critical | 9.8 | 2026-01-21 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which… |
CVE-2025-69763 | Critical | 9.8 | 2026-01-21 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and enable remote code exe… |
CVE-2025-69762 | Critical | 9.8 | 2026-01-21 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execu… |
CVE-2021-47802 | High | 7.5 | 2026-01-21 | Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files… |
CVE-2025-70648 | High | 7.5 | 2026-01-21 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to… |
CVE-2025-70646 | High | 7.5 | 2026-01-21 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to ca… |
CVE-2025-70644 | High | 7.5 | 2026-01-21 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause… |
CVE-2025-70651 | High | 7.5 | 2026-01-21 | Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows a… |
CVE-2025-70650 | High | 7.5 | 2026-01-21 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows at… |
CVE-2025-70645 | High | 7.5 | 2026-01-21 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allow… |
CVE-2025-71020 | High | 7.5 | 2026-01-16 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to c… |
CVE-2025-70746 | High | 7.5 | 2026-01-16 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers… |
CVE-2025-70656 | High | 7.5 | 2026-01-15 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function. This vulnerability allows attackers to cause… |
CVE-2025-71019 | High | 7.5 | 2026-01-15 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. This vulnerability allows attackers to c… |
CVE-2025-70744 | High | 7.5 | 2026-01-15 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function. This vulnerability allows attackers to… |
CVE-2025-71021 | High | 7.5 | 2026-01-14 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to… |
CVE-2025-70747 | High | 7.5 | 2026-01-14 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers t… |
CVE-2025-71027 | High | 7.5 | 2026-01-13 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows a… |
CVE-2025-71026 | High | 7.5 | 2026-01-13 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows… |
CVE-2025-71025 | High | 7.5 | 2026-01-13 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allow… |
CVE-2025-71024 | High | 7.5 | 2026-01-13 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability all… |
CVE-2025-71023 | High | 7.5 | 2026-01-13 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows atta… |
CVE-2025-70753 | High | 7.5 | 2026-01-13 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers t… |
CVE-2026-22082 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session… | |
CVE-2026-22081 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookie… | |
CVE-2026-22080 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded usin… | |
CVE-2026-22079 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credenti… | |
CVE-2026-0640 | High | 8.8 | 2026-01-06 | A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the ar… |
CVE-2026-0581 | Medium | 6.3 | 2026-01-05 | A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of t… |
CVE-2025-15371 | High | 7.8 | 2025-12-31 | A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the c… |
CVE-2025-15356 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation… |
CVE-2025-15255 | Critical | 9.8 | 2025-12-30 | A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Exe… |
CVE-2025-15254 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a man… |
CVE-2025-15253 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the… |
CVE-2025-15252 | High | 8.8 | 2025-12-30 | A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation… |
CVE-2025-15234 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This m… |
CVE-2025-15233 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The m… |
CVE-2025-15232 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The man… |
CVE-2025-15231 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipul… |
CVE-2025-15230 | High | 8.8 | 2025-12-30 | A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performin… |
CVE-2025-15229 | Medium | 5.3 | 2025-12-30 | A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClien… |
CVE-2025-15218 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSe… |
CVE-2025-15217 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Perform… |
CVE-2025-15216 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the… |
CVE-2025-15215 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the… |
CVE-2025-15180 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HT… |
CVE-2025-15179 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/qossetting. This manipulation of the argument page… |
CVE-2025-15178 | High | 7.2 | 2025-12-29 | A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Hand… |
CVE-2025-15177 | High | 7.2 | 2025-12-29 | A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Han… |
CVE-2025-15164 | High | 7.2 | 2025-12-29 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument p… |
CVE-2025-15163 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulat… |
CVE-2025-15162 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a… |
CVE-2025-15161 | High | 7.2 | 2025-12-28 | A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argume… |
CVE-2025-15160 | High | 7.2 | 2025-12-28 | A vulnerability has been found in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/PPTPServer. Such manipulation of the argument ip1… |
CVE-2025-15076 | High | 7.3 | 2025-12-25 | A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal… |
CVE-2025-15048 | High | 7.3 | 2025-12-23 | A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler… |
CVE-2025-15047 | Critical | 9.8 | 2025-12-23 | A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Perf… |
CVE-2025-15046 | Critical | 9.8 | 2025-12-23 | A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Reques… |
CVE-2025-15045 | Critical | 9.8 | 2025-12-23 | A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler… |
CVE-2025-15044 | Critical | 9.8 | 2025-12-23 | A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument pa… |
CVE-2025-15010 | Critical | 9.8 | 2025-12-22 | A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the a… |
CVE-2025-15008 | High | 7.3 | 2025-12-22 | A vulnerability was detected in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/L7Port of the component HTTP Request Handler. Performing… |
CVE-2025-15007 | Critical | 9.8 | 2025-12-22 | A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the compon… |
CVE-2025-15006 | Critical | 9.8 | 2025-12-22 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the compon… |
CVE-2025-14995 | High | 8.8 | 2025-12-21 | A vulnerability has been found in Tenda FH1201 1.2.0.14(408). Affected is the function sprintf of the file /goform/SetIpBind. Such manipulation of the argument… |
CVE-2025-14994 | High | 8.8 | 2025-12-21 | A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the compon… |
CVE-2025-14993 | High | 8.8 | 2025-12-21 | A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler… |
CVE-2025-14992 | High | 8.8 | 2025-12-21 | A security vulnerability has been detected in Tenda AC18 15.03.05.05. The impacted element is the function strcpy of the file /goform/GetParentControlInfo of t… |
CVE-2025-14879 | Critical | 9.8 | 2025-12-18 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler… |
CVE-2025-14878 | Critical | 9.8 | 2025-12-18 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirelessRestart of the component HTTP Request… |
CVE-2025-67074 | Medium | 6.5 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service… |
CVE-2025-67073 | Critical | 9.8 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service… |
CVE-2025-14665 | Critical | 9.8 | 2025-12-14 | A security flaw has been discovered in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/DhcpListClient of the component HTTP Request H… |
CVE-2025-14656 | High | 8.8 | 2025-12-14 | A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the ar… |
CVE-2025-14655 | High | 8.8 | 2025-12-14 | A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg… |
CVE-2025-14654 | High | 8.8 | 2025-12-14 | A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the c… |
CVE-2025-14636 | Low | 3.7 | 2025-12-13 | A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of… |
CVE-2025-14526 | High | 8.8 | 2025-12-11 | A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the arg… |
CVE-2025-14286 | Medium | 5.3 | 2025-12-09 | A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg… |
CVE-2025-65804 | Medium | 6.5 | 2025-12-08 | Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution… |
CVE-2025-65226 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo. |
CVE-2025-65223 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo. |
CVE-2025-65222 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg. |
CVE-2025-65221 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList. |
CVE-2025-65220 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter. |
CVE-2025-13446 | High | 8.8 | 2025-11-20 | A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the ar… |
CVE-2025-13445 | High | 8.8 | 2025-11-20 | A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list c… |
CVE-2025-13400 | High | 8.8 | 2025-11-19 | A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing a manipulation of the… |
CVE-2025-13288 | High | 8.8 | 2025-11-17 | A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipu… |
CVE-2025-13258 | High | 8.8 | 2025-11-17 | A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of… |