G3 Firmware vulnerabilities

9 known vulnerabilities in G3 Firmware from Tendacn. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

9vulnerabilities

5critical

4high

0exploited

8.8average CVSS score

Latest first

7.5 High severity
G1 Firmware: Out-of-bounds Write
CVE-2022-24172Feb 4, 2022TendacnEPSS 1.18%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.
9.8 Critical severity
G1 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-24171Feb 4, 2022TendacnEPSS 2.96%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoe
9.8 Critical severity
G1 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-24170Feb 4, 2022TendacnEPSS 2.96%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.
7.5 High severity
G1 Firmware: Out-of-bounds Write
CVE-2022-24169Feb 4, 2022TendacnEPSS 1.18%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter.
9.8 Critical severity
G1 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-24168Feb 4, 2022TendacnEPSS 2.96%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters.
9.8 Critical severity
G1 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-24167Feb 4, 2022TendacnEPSS 2.96%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.
7.5 High severity
G1 Firmware: Out-of-bounds Write
CVE-2022-24166Feb 4, 2022TendacnEPSS 1.18%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter.
9.8 Critical severity
G1 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-24165Feb 4, 2022TendacnEPSS 2.96%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.
7.5 High severity
G1 Firmware: Out-of-bounds Write
CVE-2022-24164Feb 4, 2022TendacnEPSS 1.18%
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsHijackRule parameter.