Tenda AC6 operating system command injection vulnerability (CNVD-2026-38719)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the fromSetWirelessRepeat function in the httpd component’s goform/WifiExtraSet module, which processes parameters...

CVE-2026-2877: Stack-based Buffer Overflow

A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2026-1420: Buffer Copy without Checking Size of Input

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2025-13258: Buffer Copy without Checking Size of Input

A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used...

CVE-2025-10838: Buffer Copy without Checking Size of Input

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and...

CVE-2025-1814: Stack-based Buffer Overflow

A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is some unknown functionality of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto leads to stack-based buffer overflow. The attack may be launched remotel...

PT-2025-9185

Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.05.16 Description A critical issue has been found in Tenda AC6, affecting some unknown functionality of the file /goform/WifiExtraSet. The manipulation of the wpapsk crypto argument leads to a stack-based buffer overflo...

The vulnerability of the FUN_0046AC38 function in the /goform/WifiExtraSet file of the Tenda AC10 router microprogramming system, which allows a intruder to cause a service failure.

The vulnerability of the FUN0046AC38 function in the /goform/WifiExtraSet module of the Tenda AC10 router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a...

CVE-2023-41554

Tenda AC9 V3.0 V15.03.06.42multi was discovered to contain a stack overflow via parameter wpapskcrypto at url /goform/WifiExtraSet...

CVE-2023-41554: Out-of-bounds Write

Tenda AC9 V3.0 V15.03.06.42multi was discovered to contain a stack overflow via parameter wpapskcrypto at url /goform/WifiExtraSet...

CVE-2022-30475

Tenda AC Series Router AC18V15.03.05.196318 was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/WifiExtraSet request...

Stack overflow

Tenda AC Series Router AC18V15.03.05.196318 was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/WifiExtraSet request...

CVE-2022-30475: Out-of-bounds Write

Tenda AC Series Router AC18V15.03.05.196318 was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/WifiExtraSet request...

PT-2022-18403

Name of the Vulnerable Software and Affected Versions Tenda AX12 version V22.03.01.21 CN Description A Cross-Site Request Forgery CSRF issue was found, related to the function sub 422168 at the /goform/WifiExtraSet API endpoint. Recommendations For Tenda AX12 version V22.03.01.21 CN, as a tempora...

CVE-2022-27375: Cross-Site Request Forgery (CSRF)

Tenda AX12 V22.03.01.21CN was discovered to contain a Cross-Site Request Forgery CSRF via the function sub422168 at /goform/WifiExtraSet...

PT-2022-3390

Name of the Vulnerable Software and Affected Versions Tenda AC Series Router version AC18 V15.03.05.196318 Description The issue is related to a stack-based buffer overflow in the httpd module when handling the "/goform/WifiExtraSet" API endpoint. This can potentially allow an attacker to cause a...