CVE Intelligence

Vulnerabilidades de Tenda

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Tenda: 509 registro(s), com severidade, exploração e correções.

CH22 34F453 Firmware 30F453 30Ch22 Firmware 29F456 28F456 Firmware 22Wh450 Firmware 21WH450 21F451 20Ac7 Firmware 17Ac21 Firmware 16Ax3 Firmware 16F451 Firmware 16Ac6 Firmware 15Ac15 Firmware 14Ac18 Firmware 14HG10 14W30e Firmware 13AC18 12Ax1806 Firmware 11AC21 11HG9 10AC9 10AC15 10Ac9 Firmware 9W20e Firmware 9CP3 9Ac10 Firmware 8Ac23 Firmware 8I3 8M3 Firmware 8Ac8 Firmware 8I3 Firmware 8AC7 8CX12L 8M3 8AC8 8AC23 8W20E 8Ac20 Firmware 7

Somente exploradas (KEV) →

CVE-2025-13288 Alta · 8.8 CWE-119 17/11/2025
Tenda CH22 PPTPUserSetting fromPptpUserSetting buffer overflow
A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-13258 Alta · 8.8 CWE-119 17/11/2025
Tenda AC20 WifiExtraSet buffer overflow
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2025-63666 Crítica · 9.8 CWE-284 12/11/2025
Improper Access Control em Tenda Ac15 Firmware
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
CVE-2025-63149 Alta · 7.5 CWE-121 10/11/2025
Stack-based Buffer Overflow em Tenda Ax3 Firmware
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63835 Alta · 8.8 CWE-787 10/11/2025
Out-of-bounds Write em Tenda Ac18 Firmware
A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the guestSsid parameter of the /goform/WifiGuestSet interface. Remote attackers can exploit this vulnerability by sending oversized data to the guestSsid parameter, leading to denial of service (device crash) or potential remote code execution.
CVE-2025-63834 Média · 5.4 CWE-79 10/11/2025
Cross-site Scripting (XSS) em Tenda Ac18 Firmware
A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.
CVE-2025-63457 Alta · 7.5 CWE-787 10/11/2025
Out-of-bounds Write em Tenda Ax1803 Firmware
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63456 Alta · 7.5 CWE-787 10/11/2025
Out-of-bounds Write em Tenda Ax1803 Firmware
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63455 Alta · 7.5 CWE-121 10/11/2025
Stack-based Buffer Overflow em Tenda Ax3 Firmware
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63147 Alta · 7.5 CWE-787 10/11/2025
Out-of-bounds Write em Tenda Ax3 Firmware
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63152 Alta · 7.5 CWE-121 10/11/2025
Stack-based Buffer Overflow em Tenda Ax3 Firmware
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-12622 Crítica · 9.8 CWE-120 03/11/2025
Tenda AC10 SysRunCmd formSysRunCmd buffer overflow
A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This manipulation of the argument getui causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-12619 Crítica · 9.8 CWE-120 03/11/2025
Tenda A15 openNetworkGateway fromSetWirelessRepeat buffer overflow
A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of the argument wpapsk_crypto2_4g results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2025-12618 Crítica · 9.8 CWE-120 03/11/2025
Tenda AC8 DatabaseIniSet buffer overflow
A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-12611 Crítica · 9.8 CWE-120 03/11/2025
Tenda AC21 SetPptpServerCfg formSetPPTPServer buffer overflow
A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2025-12596 Crítica · 9.8 CWE-120 02/11/2025
Tenda AC23 saveParentControlInfo buffer overflow
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo. Such manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-12595 Crítica · 9.8 CWE-120 02/11/2025
Tenda AC23 SetVirtualServerCfg formSetVirtualSer buffer overflow
A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-63458 Alta · 7.5 CWE-121 31/10/2025
Stack-based Buffer Overflow em Tenda Ax1803 Firmware
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63454 Alta · 7.5 CWE-121 31/10/2025
Stack-based Buffer Overflow em Tenda Ax3 Firmware
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-61498 Alta · 7.5 CWE-121 30/10/2025
Stack-based Buffer Overflow em Tenda Ac8 Firmware
A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet.
CVE-2025-12322 Alta · 8.8 CWE-120 27/10/2025
Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflow
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a manipulation of the argument page can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVE-2025-12274 Alta · 8.8 CWE-119 27/10/2025
Tenda CH22 P2pListFilter fromP2pListFilter buffer overflow
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2025-12273 Crítica · 9.8 CWE-119 27/10/2025
Tenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflow
A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-12272 Crítica · 9.8 CWE-119 27/10/2025
Tenda CH22 addressNat fromAddressNat buffer overflow
A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation of the argument page results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-12271 Crítica · 9.8 CWE-119 27/10/2025
Tenda CH22 RouteStatic fromRouteStatic buffer overflow
A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.