Tenda has 135 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 19 in the last 90 days against 7 in the 90 before. The busiest recent month was December 2025 with 35. The median CVSS is 8.8 (high), with 24 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-119 (97) and CWE-121 (67). Most affected products: ch22_firmware (21), wh450_firmware (12), ac18_firmware (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 19 prev 7
Weakness classes
Products
- ch22_firmware 21
- wh450_firmware 12
- ac18_firmware 11
- ac7_firmware 7
- CP3 6
- ac20_firmware 6
Worst active — by depth score
CVE-2022-30023High· 8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.74CVE-2026-105778Critical· 9.9A vulnerability has been found in Tenda AC5 02.03.01.111_multi67CVE-2026-104610Critical· 10.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon67CVE-2026-86167Critical· 9.9A vulnerability was identified in Tenda HG10 30000113867CVE-2026-11499Critical· 9.8A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon67
Tenda vulnerabilities
CVEs affecting Tenda, newest first. Open any entry for full detail, references, and exploit status.
135 CVEsRSS
CVE-2026-115796Medium· 4.3Tenda F6 Web Management cross-site request forgery
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotel…
CVE-2026-115797Low· 3.7Tenda F6 Web Management cleartext transmission
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive informati…
CVE-2026-114268Critical· 9.9Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible t…
CVE-2026-113744Critical· 10.0Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argu…
CVE-2026-105778Critical· 9.9PoCA vulnerability has been found in Tenda AC5 02.03.01.111_multi
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-base…
CVE-2026-104610Critical· 10.0PoCA security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype lea…
CVE-2026-104611Critical· 9.1A vulnerability was detected in Tenda AC9 15.03.02.13
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in s…
CVE-2026-90688Medium· 6.5PoCA vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC
A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overf…
CVE-2026-90689High· 8.8A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. Th…
CVE-2026-86300High· 7.3PoCA flaw has been found in Tenda AC9 15.03.05.14
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been…
CVE-2026-86167Critical· 9.9PoCA vulnerability was identified in Tenda HG10 300001138
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remot…
CVE-2026-86166High· 8.8PoCA vulnerability was determined in Tenda HG10 300001138
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer …
CVE-2026-86165Critical· 9.8PoCA vulnerability was found in Tenda HG10 300001138
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be …
CVE-2026-86153Critical· 9.1A vulnerability has been found in Tenda CP3 27.5.57.101
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the at…
CVE-2026-86152Critical· 10.0A flaw has been found in Tenda CP3 27.5.57.101
A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The at…
CVE-2026-86151Critical· 9.1PoCA vulnerability was detected in Tenda CP3 27.5.57.101
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection…
CVE-2026-86150Medium· 4.1A security vulnerability has been detected in Tenda CP3 27.5.57.101
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be…
CVE-2026-86149Critical· 9.1A weakness has been identified in Tenda CP3 27.5.57.101
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be in…
CVE-2026-86148Critical· 9.1A security flaw has been discovered in Tenda CP3 27.5.57.101
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command inject…
CVE-2026-11498High· 8.8A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon
A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of …
CVE-2026-11553High· 8.8PoCA vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon
A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attac…
CVE-2026-11499Critical· 9.8PoCA vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon
A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer ov…
CVE-2026-8265Medium· 4.7A security vulnerability has been detected in Tenda AC6 15.03.06.23
A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os comman…
CVE-2026-8264Medium· 6.3A weakness has been identified in Tenda AC6 15.03.06.23
A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl…
CVE-2026-8263Medium· 4.7A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results …
CVE-2026-8259Medium· 4.7A vulnerability has been found in Tenda AC6 2.0/15.03.06.23
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exp…
CVE-2018-25318Critical· 9.8PoCTenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change
Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/Adv…
CVE-2018-25317Critical· 9.8PoCTenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send G…
CVE-2025-52221Critical· 9.8Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
CVE-2026-5687High· 8.8A weakness has been identified in Tenda CX12L 16.03.53.12
A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack m…