Vulnerabilidades de Tenda

CVE-2026-13517 Alta · 8.8 CWE-119 28/06/2026

Tenda JD12L WifiBasicSet formWifiBasicSet stack-based overflow

A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

CVE-2026-13516 Alta · 8.8 CWE-119 28/06/2026

Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow

A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-13515 Alta · 8.8 CWE-119 28/06/2026

Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow

A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-51846 Crítica · 9.8 CWE-121 19/06/2026

Estouro de Buffer na Pilha no Parâmetro wanSpeed do Firmware Tenda AC7 (CVE-2026-51846)

No Tenda AC7 v15.03.06.44, o parâmetro wanSpeed da rota /goform/AdvSetMacMtuWan apresenta uma vulnerabilidade de estouro de buffer na pilha que pode levar à execução remota arbitrária de código.

CVE-2026-51845 Crítica · 9.8 CWE-121 19/06/2026

Tenda AC7: estouro de buffer baseado em pilha na interface AdvSetMacMtuWan

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha na interface /goform/AdvSetMacMtuWan por meio do parâmetro mac.

CVE-2026-51844 Crítica · 9.8 CWE-121 19/06/2026

Estouro de buffer na pilha no Tenda AC7 em AdvSetMacMtuWan via cloneType

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha (stack buffer overflow) na interface /goform/AdvSetMacMtuWan por meio do parâmetro cloneType.

CVE-2026-51843 Crítica · 9.8 CWE-121 19/06/2026

Estouro de buffer na pilha no firmware do Tenda AC7 no tratamento de wanMTU

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha (stack buffer overflow) na interface /goform/AdvSetMacMtuWan, através do parâmetro wanMTU.

CVE-2026-11557 Alta · 8.8 CWE-119 08/06/2026

Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-11556 Alta · 8.8 CWE-77 08/06/2026

Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVE-2026-11553 Alta · 8.8 CWE-119 08/06/2026

Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

CVE-2026-11528 Alta · 8.8 CWE-119 08/06/2026

Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow

A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of the component Web Management Interface. The manipulation of the argument callback results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

CVE-2026-11524 Alta · 8.8 CWE-119 08/06/2026

Tenda W20E Web Management modifyWifiFilterRules stack-based overflow

A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-11523 Alta · 8.8 CWE-119 08/06/2026

Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow

A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management Interface. Executing a manipulation of the argument gotoUrl can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

CVE-2026-11522 Alta · 8.8 CWE-119 08/06/2026

Tenda W20E setPortMirror formSetPortMirror stack-based overflow

A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

CVE-2026-11504 Alta · 8.8 CWE-119 08/06/2026

Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow

A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-11503 Alta · 8.8 CWE-119 08/06/2026

Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow

A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-11499 Crítica · 9.8 CWE-119 08/06/2026

Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow

A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

CVE-2026-11498 Alta · 8.8 CWE-119 08/06/2026

Tenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely.

CVE-2026-11493 Média · 5.0 CWE-521 08/06/2026

Tenda AC15 Samba smb.conf weak password

A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.

CVE-2026-10192 Alta · 8.8 CWE-119 31/05/2026

Tenda W12 httpd set_local_time_0 stack-based overflow

A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2026-10191 Alta · 8.8 CWE-119 31/05/2026

Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow

A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-10190 Média · 6.5 CWE-404 31/05/2026

Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service

A vulnerability was found in Tenda W12 3.0.0.7(4763). This issue affects the function cgiSysWebTimeoutSet of the file /bin/httpd of the component Web Management Interface. The manipulation of the argument web_over_time results in denial of service. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVE-2026-10189 Alta · 8.8 CWE-119 31/05/2026

Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow

A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-10188 Alta · 8.8 CWE-119 31/05/2026

Tenda W12 httpd cgistaKickOff stack-based overflow

A flaw has been found in Tenda W12 3.0.0.7(4763). This affects the function cgistaKickOff of the file /bin/httpd. Executing a manipulation of the argument staMac can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

CVE-2026-9431 Alta · 8.8 CWE-119 25/05/2026

Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow

A vulnerability was identified in Tenda F1202 1.2.0.20(408). This affects the function fromPptpUserAdd of the file /goform/PptpUserAdd. The manipulation of the argument opttype leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.