Tenda has 135 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 19 in the last 90 days against 7 in the 90 before. The busiest recent month was December 2025 with 35. The median CVSS is 8.8 (high), with 24 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-119 (97) and CWE-121 (67). Most affected products: ch22_firmware (21), wh450_firmware (12), ac18_firmware (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 19 prev 7
Weakness classes
Products
- ch22_firmware 21
- wh450_firmware 12
- ac18_firmware 11
- ac7_firmware 7
- CP3 6
- ac20_firmware 6
Worst active — by depth score
CVE-2022-30023High· 8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.74CVE-2026-114268Critical· 9.9Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow67CVE-2026-113744Critical· 10.0Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow67CVE-2026-105778Critical· 9.9A vulnerability has been found in Tenda AC5 02.03.01.111_multi67CVE-2026-104610Critical· 10.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon67
Tenda vulnerabilities
CVEs affecting Tenda, newest first. Open any entry for full detail, references, and exploit status.
135 CVEsRSS
CVE-2025-12209High· 8.8A vulnerability was determined in Tenda O3 1.0.0.10(2478)
A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack …
CVE-2025-12234High· 8.8A vulnerability has been found in Tenda CH22 1.0.0.1
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. Th…
CVE-2025-12232High· 8.8A vulnerability was detected in Tenda CH22 1.0.0.1
A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in buffer overflow. The …
CVE-2025-12210High· 8.8A vulnerability was identified in Tenda O3 1.0.0.10(2478)
A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It …
CVE-2025-11586High· 8.8A vulnerability was determined in Tenda AC7 15.03.06.44
A vulnerability was determined in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/setNotUpgrade. This manipulation of the argument newVersion causes stack-based buffer overflow. The attack is possible to be ca…
CVE-2025-11550Medium· 6.5A vulnerability was found in Tenda W12 3.0.0.6(3948)
A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in n…
CVE-2025-11549High· 8.8A vulnerability has been found in Tenda W12 3.0.0.6(3948)
A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based…
CVE-2025-11528High· 8.8A vulnerability was identified in Tenda AC7 15.03.06.44
A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is…
CVE-2025-11527High· 8.8A vulnerability was determined in Tenda AC7 15.03.06.44
A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a manipulation of the argument Password can lead to stack-based buffer overflow. T…
CVE-2025-11526High· 8.8A vulnerability was found in Tenda AC7 15.03.06.44
A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack…
CVE-2025-11525High· 8.8A vulnerability has been found in Tenda AC7 15.03.06.44
A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. …
CVE-2025-11524High· 8.8A flaw has been found in Tenda AC7 15.03.06.44
A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely.…
CVE-2025-11523Medium· 6.3A vulnerability was detected in Tenda AC7 15.03.06.44
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remo…
CVE-2025-11423Critical· 9.8A vulnerability was found in Tenda CH22 1.0.0.1
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation of the argument page results in memory corruption. The attack is possible to be…
CVE-2025-11418Critical· 9.8A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1
A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP Request Handler. The manipulation of the argument mit_ssid_…
CVE-2025-11389High· 8.8A security flaw has been discovered in Tenda AC15 15.03.05.18
A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of the argument enable results in stack-based buffer overflow. Remote exploitation …
CVE-2025-11388High· 8.8A vulnerability was identified in Tenda AC15 15.03.05.18
A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack may be launched r…
CVE-2025-11387High· 8.8A vulnerability was determined in Tenda AC15 15.03.05.18
A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This manipulation of the argument Password causes stack-based buffer overflow. The attack may be initi…
CVE-2025-11386High· 8.8A vulnerability was found in Tenda AC15 15.03.05.18
A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the component POST Parameter Handler. The manipulation of the argument ddnsEn results in stack-based buffe…
CVE-2025-11385High· 8.8A vulnerability has been found in Tenda AC20 up to 16.03.08.12
A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to buffer overflow. The attack can be …
CVE-2025-11356High· 8.8A vulnerability was found in Tenda AC23 up to 16.03.07.52
A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. It is possible to launch th…
CVE-2025-11328High· 8.8A vulnerability was detected in Tenda AC18 15.03.05.19(6318)
A vulnerability was detected in Tenda AC18 15.03.05.19(6318). This issue affects some unknown processing of the file /goform/SetDDNSCfg. The manipulation of the argument ddnsEn results in stack-based buffer overflow. It is possible to la…
CVE-2025-11327High· 8.8A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318)
A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318). This vulnerability affects unknown code of the file /goform/SetUpnpCfg. The manipulation of the argument upnpEn leads to stack-based buffer overflow. It is possi…
CVE-2025-11326High· 8.8A weakness has been identified in Tenda AC18 15.03.05.19(6318)
A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of the argument wifi_chkHz can lead to stack-based buffer overflow. The attack ma…
CVE-2025-11325High· 8.8A security flaw has been discovered in Tenda AC18 15.03.05.19(6318)
A security flaw has been discovered in Tenda AC18 15.03.05.19(6318). Affected by this issue is some unknown functionality of the file /goform/fast_setting_pppoe_set. Performing a manipulation of the argument Username results in stack-bas…
CVE-2025-11324High· 8.8A vulnerability was identified in Tenda AC18 15.03.05.19(6318)
A vulnerability was identified in Tenda AC18 15.03.05.19(6318). Affected by this vulnerability is an unknown functionality of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overfl…
CVE-2025-11091High· 8.8A security flaw has been discovered in Tenda AC21 up to 16.03.08.16
A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attac…
CVE-2025-11123High· 8.8A flaw has been found in Tenda AC18 15.03.05.19
A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable causes stack-based buffer overflow. The attack may be initiated remotely. The exp…
CVE-2025-11121Medium· 6.3A security vulnerability has been detected in Tenda AC18 15.03.05.19
A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initi…
CVE-2025-11120High· 8.8A weakness has been identified in Tenda AC8 16.03.34.06
A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attac…