VulnSea

Tenda has 136 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 20 in the last 90 days against 7 in the 90 before. The busiest recent month was December 2025 with 35. The median CVSS is 8.8 (high), with 24 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-119 (97) and CWE-121 (67). Most affected products: ch22_firmware (21), wh450_firmware (12), ac18_firmware (11).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
1% vs 1% corpus
Median CVSS
8.8
Publish → KEV
—
Last 90 days
20 prev 7

Products

  • ch22_firmware 21
  • wh450_firmware 12
  • ac18_firmware 11
  • ac7_firmware 7
  • CP3 6
  • ac20_firmware 6
Follow Tenda:RSS feedSave a search →Embed badge ↗
136
Total CVEs
24
Critical
0
CISA KEV
1
Exploited

Worst active — by depth score

Tenda vulnerabilities

CVEs affecting Tenda, newest first. Open any entry for full detail, references, and exploit status.

136 CVEsRSS

CVE-2025-11120High· 8.8
1y ago

A weakness has been identified in Tenda AC8 16.03.34.06

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attac…

▾ Twilighttenda · ac18_firmwareEPSS 3.9%via NVD
CVE-2025-11117High· 8.8
1y ago

A vulnerability was determined in Tenda CH22 1.0.0.1

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be …

▾ Twilighttenda · ch22_firmwareEPSS 0.82%via NVD
CVE-2025-11122High· 8.8
1y ago

A vulnerability was detected in Tenda AC18 15.03.05.19

A vulnerability was detected in Tenda AC18 15.03.05.19. This affects an unknown function of the file /goform/WizardHandle. The manipulation of the argument WANT/mtuvalue results in stack-based buffer overflow. The attack can be launched …

▾ Twilighttenda · ac18_firmwareEPSS 0.82%via NVD
CVE-2025-10838High· 8.8
1y ago

A vulnerability was identified in Tenda AC21 16.03.08.16

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub_45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to buffer overflow. It is possible to initia…

▾ Twilighttenda · ac21_firmwareEPSS 1.1%via NVD
CVE-2025-10815High· 8.8
1y ago

A vulnerability was identified in Tenda AC20 up to 16.03.08.12

A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp lead…

▾ Twilighttenda · ac20_firmwareEPSS 0.88%via NVD
CVE-2025-9828Low· 3.7
1y ago

A vulnerability was determined in Tenda CP6 11.10.00.243

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This…

▾ Sunlittenda · cp6_firmwareEPSS 0.36%via NVD
CVE-2025-9806Low· 1.9
1y ago

A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20

A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded cr…

▾ Sunlittenda · f1202_firmwareEPSS 0.16%via NVD
CVE-2025-9813High· 8.8
1y ago

A vulnerability was identified in Tenda CH22 1.0.0.1

A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initi…

▾ Twilighttenda · ch22_firmwareEPSS 1.00%via NVD
CVE-2025-9812High· 8.8
1y ago

A vulnerability was determined in Tenda CH22 1.0.0.1

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be p…

▾ Twilighttenda · ch22_firmwareEPSS 0.69%via NVD
CVE-2025-9791High· 8.8
1y ago

A weakness has been identified in Tenda AC20 16.03.08.05

A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation o…

▾ Twilighttenda · ac20_firmwareEPSS 0.90%via NVD
CVE-2025-57220Medium· 5.3
1y ago

An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet.

An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet.

▾ Sunlittenda · ac10_firmwareEPSS 0.80%via NVD
CVE-2025-57218Medium· 5.3
1y ago

Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.

Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.

▾ Sunlittenda · ac10_firmwareEPSS 0.59%via NVD
CVE-2025-52054Medium· 5.3
1y ago

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device.…

▾ Sunlittenda · ac8_firmwareEPSS 0.31%via NVD
CVE-2022-35201Critical· 9.8
4y ago

Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.

Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.

▾ Midnighttenda · ac18_firmwareEPSS 3.6%via NVD
CVE-2022-30023High· 8.8⚠ ExploitedPoC
4y ago

Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.

Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.

▾ Midnighttenda · hg9_firmwareEPSS 39%via NVD
CVE-2021-44971Critical· 9.8
4y ago

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticate…

▾ Midnighttenda · ac15_firmwareEPSS 2.1%via NVD
Tenda vulnerabilities (CVEs) — page 5 · VulnSea