Tenda has 135 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 19 in the last 90 days against 7 in the 90 before. The busiest recent month was December 2025 with 35. The median CVSS is 8.8 (high), with 24 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-119 (97) and CWE-121 (67). Most affected products: ch22_firmware (21), wh450_firmware (12), ac18_firmware (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 19 prev 7
Weakness classes
Products
- ch22_firmware 21
- wh450_firmware 12
- ac18_firmware 11
- ac7_firmware 7
- CP3 6
- ac20_firmware 6
Worst active — by depth score
CVE-2022-30023High· 8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.74CVE-2026-114268Critical· 9.9Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow67CVE-2026-113744Critical· 10.0Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow67CVE-2026-105778Critical· 9.9A vulnerability has been found in Tenda AC5 02.03.01.111_multi67CVE-2026-104610Critical· 10.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon67
Tenda vulnerabilities
CVEs affecting Tenda, newest first. Open any entry for full detail, references, and exploit status.
135 CVEsRSS
CVE-2026-5686High· 8.8A security flaw has been discovered in Tenda CX12L 16.03.53.12
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The at…
CVE-2026-5685High· 8.8A vulnerability was identified in Tenda CX12L 16.03.53.12
A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated r…
CVE-2026-5684High· 8.0A vulnerability was determined in Tenda CX12L 16.03.53.12
A vulnerability was determined in Tenda CX12L 16.03.53.12. Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to stack-based bu…
CVE-2026-5683Medium· 5.5A vulnerability was found in Tenda CX12L 16.03.53.12
A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overfl…
CVE-2026-5609High· 8.8A flaw has been found in Tenda i12 1.0.0.11(3862)
A flaw has been found in Tenda i12 1.0.0.11(3862). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset of the component Parameter Handler. This manipulation of the argument index/wl_radio causes …
CVE-2026-5605High· 8.8A weakness has been identified in Tenda CH22 1.0.0.1
A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be execu…
CVE-2026-5567High· 8.8A flaw has been found in Tenda M3 1.0.0.10
A flaw has been found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Destination Handler. Executing a manipulation of the argument policyType can lead …
CVE-2026-5527Medium· 5.3A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53
A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the file /etc/www/pem/server.key of the component ECDSA P-256 Private Key Handler. This manipulation c…
CVE-2026-5526High· 7.3A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The att…
CVE-2026-5204High· 8.8A vulnerability was determined in Tenda CH22 1.0.0.1
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffe…
CVE-2025-15234High· 8.8A weakness has been identified in Tenda M3 1.0.0.13(4903)
A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This manipulation of the argument portIp/portMask/portGateWay/portDns/portSecDns cau…
CVE-2025-15233High· 8.8A security flaw has been discovered in Tenda M3 1.0.0.13(4903)
A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The manipulation of the argument adName/smsPassword/smsAccount/weixinAccount/weixin…
CVE-2025-15232High· 8.8A vulnerability was identified in Tenda M3 1.0.0.13(4903)
A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal leads to stack-based buffer overflow. T…
CVE-2025-15231High· 8.8A vulnerability was determined in Tenda M3 1.0.0.13(4903)
A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipulation of the argument ID/vlan/port can lead to stack-based buffer overflow. Th…
CVE-2025-15230High· 8.8A vulnerability was found in Tenda M3 1.0.0.13(4903)
A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performing a manipulation of the argument qvlan_truck_port results in heap-based buffer…
CVE-2025-15229Medium· 5.3A vulnerability has been found in Tenda CH22 up to 1.0.0.1
A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClient. Such manipulation of the argument LISTLEN leads to denial of service. The a…
CVE-2025-15218High· 8.8A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49
A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing a manipulati…
CVE-2025-15217High· 8.8A security flaw has been discovered in Tenda AC23 16.03.07.52
A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack…
CVE-2025-15216High· 8.8A vulnerability was identified in Tenda AC23 16.03.07.52
A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument bindnum leads to stack-based buffer overflow. It is possible to laun…
CVE-2025-15215High· 8.8A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49
A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list c…
CVE-2025-15164High· 7.2A security flaw has been discovered in Tenda WH450 1.0.0.18
A security flaw has been discovered in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from r…
CVE-2025-15163High· 7.2A vulnerability was identified in Tenda WH450 1.0.0.18
A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack is p…
CVE-2025-15162High· 7.2A vulnerability was determined in Tenda WH450 1.0.0.18
A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. Th…
CVE-2025-15180High· 7.2A vulnerability was identified in Tenda WH450 1.0.0.18
A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HTTP Request Handler. Such manipulation of the argument page leads to stack-base…
CVE-2025-15179High· 7.2A vulnerability was determined in Tenda WH450 1.0.0.18
A vulnerability was determined in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/qossetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The …
CVE-2025-15178High· 7.2A vulnerability was found in Tenda WH450 1.0.0.18
A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer overf…
CVE-2025-15177High· 7.2A vulnerability has been found in Tenda WH450 1.0.0.18
A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Handler. The manipulation of the argument page leads to stack-based buffer overfl…
CVE-2025-15161High· 7.2A vulnerability was found in Tenda WH450 1.0.0.18
A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argument delno results in stack-based buffer overflow. Remote exploitation of the at…
CVE-2025-15160High· 7.2A vulnerability has been found in Tenda WH450 1.0.0.18
A vulnerability has been found in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/PPTPServer. Such manipulation of the argument ip1 leads to stack-based buffer overflow. The attack may be launched remotely. The…
CVE-2025-15076High· 7.3A weakness has been identified in Tenda CH22 1.0.0.1
A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to …