Tenda has 135 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 19 in the last 90 days against 7 in the 90 before. The busiest recent month was December 2025 with 35. The median CVSS is 8.8 (high), with 24 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-119 (97) and CWE-121 (67). Most affected products: ch22_firmware (21), wh450_firmware (12), ac18_firmware (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 19 prev 7
Weakness classes
Products
- ch22_firmware 21
- wh450_firmware 12
- ac18_firmware 11
- ac7_firmware 7
- CP3 6
- ac20_firmware 6
Worst active — by depth score
CVE-2022-30023High· 8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.74CVE-2026-114268Critical· 9.9Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow67CVE-2026-113744Critical· 10.0Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow67CVE-2026-105778Critical· 9.9A vulnerability has been found in Tenda AC5 02.03.01.111_multi67CVE-2026-104610Critical· 10.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon67
Tenda vulnerabilities
CVEs affecting Tenda, newest first. Open any entry for full detail, references, and exploit status.
135 CVEsRSS
CVE-2025-15007Critical· 9.8A security vulnerability has been detected in Tenda WH450 1.0.0.18
A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the component HTTP Request Handler. Such manipulation of the argument page leads to stac…
CVE-2025-15006Critical· 9.8A weakness has been identified in Tenda WH450 1.0.0.18
A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the component HTTP Request Handler. This manipulation of the argument ipaddress causes s…
CVE-2025-14994High· 8.8A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155)
A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the component HTTP Request Handler. This manipulation of the argument webSiteId causes s…
CVE-2025-14995High· 8.8A vulnerability has been found in Tenda FH1201 1.2.0.14(408)
A vulnerability has been found in Tenda FH1201 1.2.0.14(408). Affected is the function sprintf of the file /goform/SetIpBind. Such manipulation of the argument page leads to stack-based buffer overflow. The attack may be performed from r…
CVE-2025-14993High· 8.8A vulnerability was detected in Tenda AC18 15.03.05.05
A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler. The manipulation of the argument scanList results in stack-based buffer overf…
CVE-2025-67074Medium· 6.5A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (…
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (…
CVE-2025-67073Critical· 9.8A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (…
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (…
CVE-2025-14656High· 8.8A weakness has been identified in Tenda AC20 16.03.08.12
A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow. The attack may…
CVE-2025-14654High· 8.8A vulnerability was identified in Tenda AC20 16.03.08.12
A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Such manipulation of the argument list leads to stack-based bu…
CVE-2025-14655High· 8.8A security flaw has been discovered in Tenda AC20 16.03.08.12
A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime r…
CVE-2025-14665Critical· 9.8A security flaw has been discovered in Tenda WH450 1.0.0.18
A security flaw has been discovered in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/DhcpListClient of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer ov…
CVE-2025-14636Low· 3.7A security flaw has been discovered in Tenda AX9 22.03.01.46
A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity lev…
CVE-2025-14526High· 8.8A security flaw has been discovered in Tenda CH22 1.0.0.1
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is po…
CVE-2025-14286Medium· 5.3A vulnerability was determined in Tenda AC9 15.03.05.14_multi
A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the component Configuration File Handler. This manipulation causes informat…
CVE-2025-65804Medium· 6.5Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
CVE-2025-63152High· 7.5Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-12322High· 8.8A flaw has been found in Tenda CH22 1.0.0.1
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a manipulation of the argument page can lead to buffer overflow. It is possible to l…
CVE-2025-12274High· 8.8A security vulnerability has been detected in Tenda CH22 1.0.0.1
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote …
CVE-2025-12273High· 8.8A weakness has been identified in Tenda CH22 1.0.0.1
A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may b…
CVE-2025-12272High· 8.8A security flaw has been discovered in Tenda CH22 1.0.0.1
A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation of the argument page results in buffer overflow. The attack may be initiated re…
CVE-2025-12271High· 8.8A vulnerability was identified in Tenda CH22 1.0.0.1
A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The ex…
CVE-2025-12265High· 8.8A weakness has been identified in Tenda CH22 1.0.0.1
A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack …
CVE-2025-12236High· 8.8A vulnerability was determined in Tenda CH22 1.0.0.1
A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack…
CVE-2025-12235High· 8.0A vulnerability was found in Tenda CH22 1.0.0.1
A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in buffer overflow. The attack must originate from the lo…
CVE-2025-12233High· 8.8A flaw has been found in Tenda CH22 1.0.0.1
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack can be launche…
CVE-2025-12225High· 8.8A vulnerability has been found in Tenda AC6 15.03.06.50
A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Request Handler. Such manipulation of the argument shareSpeed leads to stack-based…
CVE-2025-12214High· 8.8A vulnerability was detected in Tenda O3 1.0.0.10(2478)
A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing a manipulation of the argument enable results in stack-based buffer overflow. The at…
CVE-2025-12213High· 8.8A security vulnerability has been detected in Tenda O3 1.0.0.10(2478)
A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflo…
CVE-2025-12212High· 8.8A weakness has been identified in Tenda O3 1.0.0.10(2478)
A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be …
CVE-2025-12211High· 8.8A security flaw has been discovered in Tenda O3 1.0.0.10(2478)
A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is…