Tenda vulnerabilities
We track 1,180 vulnerabilities in Tenda products across 60+ products. 1,180 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 14, 2026.
Latest Tenda vulnerabilities
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. T
- 9.8 Critical severity
AC20: Out-of-bounds Write
A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possibl
- 7.0 High severity
W12: Use of Hard-coded Credentials
A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. The manipulation leads to hard-coded credentials. An attack has to be approached
- 9.8 Critical severity
CH22: Out-of-bounds Write
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack
- 7.0 High severity
AC9: Use of Hard-coded Password
A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation causes hard-coded credentials. It is possible to launch the attack on t
- 9.8 Critical severity
AC21: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be
- 9.8 Critical severity
AC1206: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack r
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument new_account can lead to buffer overflow. It is possible to launch the attack remotely
- 7.0 High severity
AC10: Use of Hard-coded Password
A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degr
- 9.8 Critical severity
M3: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow.
- 9.8 Critical severity
M3: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit h
- 8.8 High severity
i22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. Performing manipulation of the argument Type results in stack-based buffer overflow. The attack can be initiated remotely
- 9.8 Critical severity
AC6 V5.0: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.
- 9.8 Critical severity
AC6 V5.0: Download of Code Without Integrity Check
A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnera
- 7.5 High severity
AC6 V5.0: Missing Release of Resource after Effective Lifetime
A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests can lead to a reboot. An attacker can send multiple network packets to trigger this vulnerability.
- 9.8 Critical severity
AC6 V5.0: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability.
- 7.5 High severity
AC6 V5.0: Authentication Bypass Using an Alternate Path or Channel
An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulner
- 9.8 Critical severity
AC6 V5.0: Missing Critical Step in Authentication
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger t
- 7.8 High severity
AC20: Use of Hard-coded Password
A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The c
- 9.8 Critical severity
AC20: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit
- 9.8 Critical severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit
- 9.8 Critical severity
AC20: Out-of-bounds Write
A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated rem
- 9.8 Critical severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetNetControlList Endpoint. The manipulation of the argument list leads to stack-based buffer overflow. I
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. Th
- 8.8 High severity
AC7: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely.
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to th
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed
- 8.8 High severity
TX3: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack ca
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this vulnerability is the function strcpy of the file /goform/saveParentControlInfo. The manipulation of the argument Time leads to buffer overflow. The attack can be launched remotely
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit ha
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical was found in Tenda AC20 16.03.08.05. Affected by this vulnerability is the function strcpy of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack c
- 7.4 High severity
AC18: Weak Password Requirements
A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiat
- 8.8 High severity
CH22: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file /goform/deleteUserName. The manipulation of the argument old_account leads to buffer overflow. The at
- 8.8 High severity
AC10: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /goform/RequestsProcessLaid. The manipulation of the argument device1D leads to heap-based buffer overflow. It is possible to launch th
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the component httpd. The manipulation of the argument timeZone leads to buffer overflow. It is possible
- 8.8 High severity
AC20: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Tenda AC20 16.03.08.05. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow.
- 8.6 High severity
Ac8 Firmware: Stack-based Buffer Overflow
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.
- 8.8 High severity
AC23: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Tenda AC23 16.03.07.52 and classified as critical. Affected by this vulnerability is the function sub_46C940 of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stac
- 8.8 High severity
AC7: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stack-based bu