Tenda vulnerabilities
We track 1,180 vulnerabilities in Tenda products across 60+ products. 1,180 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 14, 2026.
Latest Tenda vulnerabilities
- 9.8 Critical severity
W9: Out-of-bounds Write
A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initia
- 9.8 Critical severity
W9: Out-of-bounds Write
A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical. This vulnerability affects the function formQosManage_auto of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack
- 9.8 Critical severity
W9: Out-of-bounds Write
A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456). This affects the function setWrlBasicInfo of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiat
- 9.8 Critical severity
W9: Out-of-bounds Write
A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456). Affected by this issue is the function setWrlAccessList of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The at
- 9.8 Critical severity
PA6: Stack-based Buffer Overflow
A vulnerability classified as critical was found in Tenda PA6 1.0.1.21. Affected by this vulnerability is the function cgiPortMapAdd of the file /portmap of the component httpd. The manipulation of the argument groupName leads to stack-based buffer overflow. T
- 7.2 High severity
A15: Out-of-bounds Write
A vulnerability classified as critical has been found in Tenda A15 15.13.07.13. Affected is an unknown function of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument mac leads to stack-based buff
- 7.2 High severity
A15: Out-of-bounds Write
A vulnerability was found in Tenda A15 15.13.07.13. It has been rated as critical. This issue affects some unknown processing of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument devName leads t
- 7.2 High severity
A15: Out-of-bounds Write
A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_
- 7.2 High severity
A15: Out-of-bounds Write
A vulnerability was found in Tenda A15 15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/setBlackRule of the component Web-based Management Interface. The manipulation of the argument deviceList leads to stack-ba
- 7.5 High severity
Ax12 Firmware: Out-of-bounds Write
Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.
- 7.5 High severity
I29 Firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.
- 9.8 Critical severity
ax9_firmware: Improper Neutralization of Special Elements used in an SQL Command
Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules.
- 9.8 Critical severity
Ac10 Firmware: Out-of-bounds Write
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic.
- 9.8 Critical severity
Ac10 Firmware: Out-of-bounds Write
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in the function compare_parentcontrol_time.
- 9.8 Critical severity
Ac10 Firmware: Out-of-bounds Write
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.
- 9.8 Critical severity
ac10: Out-of-bounds Write
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function SetFirewallCfg.
- 9.8 Critical severity
Ax1803 Firmware: Out-of-bounds Write
Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the ssid parameter in the function form_fast_setting_wifi_set.
- 9.8 Critical severity
Ax1803 Firmware: Out-of-bounds Write
Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi.
- 9.8 Critical severity
ax1803_firmware: Improper Neutralization of Special Elements used in a Command
An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function.
- 9.8 Critical severity
Ax1803 Firmware: Out-of-bounds Write
Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the devName parameter in the function formAddMacfilterRule.
- 9.8 Critical severity
Ax1803 Firmware: Out-of-bounds Write
Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function fromSetWirelessRepeat.
- 7.5 High severity
ax1803_firmware: Out-of-bounds Write
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo . This vulnerability allows attackers to cause a Denial of Service (DoS) attack
- 7.5 High severity
ax1803_firmware: Out-of-bounds Write
Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo . This vulnerability allows attackers to cause a Denial of Service (DoS) attack
- 7.5 High severity
ax1803_firmware: Out-of-bounds Write
Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo . This vulnerability allows attackers to cause a Denial of Service (DoS) attack
- 9.8 Critical severity
Ac6 Firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm function in bin/httpd.
- 9.1 Critical severity
ax1806_firmware: Out-of-bounds Write
Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from http request parameter schedStartTime and schedEndTime without checking their size.
- 8.1 High severity
Rx9 Pro Firmware: Missing Authorization
Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device.
- 9.8 Critical severity
ac10u: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- 9.8 Critical severity
ac10u: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
- 9.8 Critical severity
ac10u: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parameter in the GetParentControlInfo function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_white_node function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the schedEndTime parameter in the setSchedWifi function.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain multiple stack overflows in the formSetMacFilterCfg function via the macFilterType and deviceList parameters.
- 9.8 Critical severity
ac10u_firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the list parameter in the fromSetIpMacBind function.
- 9.8 Critical severity
ac10v4: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.
- 9.8 Critical severity
AC8: Out-of-bounds Write
A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exp
- 9.8 Critical severity
ac6: Out-of-bounds Write
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." In the function, it reads in a user-provided parameter, and the variable is passed to the function without any length check.