CVE-2026-24103: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18multi...

CVE-2026-24105

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18multi. The value of v1 was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd...

CVE-2026-24105

The Tenda AC15V1.0 wireless router is vulnerable to a command injection flaw in the goform/formsetUsbUnload component. The root cause is the lack of validation for the v1 parameter, which is subsequently passed to the doSystemCmd function. An attacker could exploit this to execute arbitrary comma...

CVE-2026-24105: Improper Control of Generation of Code

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18multi. The value of v1 was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd...

CVE-2026-24101: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18multi. When the condition is met, s11 will be passed into subB0488, concatenated into doSystemCmd. The value of s11 is not validated, potentially leading to a command injection vulnerability...

EUVD-2026-9196

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18multi. When the condition is met, s11 will be passed into subB0488, concatenated into doSystemCmd. The value of s11 is not validated, potentially leading to a command injection vulnerability...

CVE-2024-30645

Tenda AC15V1.0 V15.03.20multi has a command injection vulnerability via the deviceName parameter...

CVE-2024-30645

Tenda AC15V1.0 V15.03.20multi has a command injection vulnerability via the deviceName parameter...

CVE-2024-30645

Tenda AC15V1.0 V15.03.20multi has a command injection vulnerability via the deviceName parameter...

CVE-2024-30645

Tenda AC15V1.0 V15.03.20multi has a command injection vulnerability via the deviceName parameter...

CVE-2024-30645

The Tenda AC15V1.0 wireless router, specifically version V15.03.20_multi , contains a command injection vulnerability. This flaw exists due to the improper neutralization of special elements used in an OS command via the deviceName parameter. Exploitation of this vulnerability could allow an atta...

CVE-2024-30645: Improper Neutralization of Special Elements used in an OS Command

Tenda AC15V1.0 V15.03.20multi has a command injection vulnerability via the deviceName parameter...

Command injection

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20multi?AC5V1.0 Firmware V15.03.06.48multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE...

CVE-2021-44971

Summary: CVE-2022-28557 is a command-injection vulnerability in the Tenda AC15 web interface (/goform/setsambacfg) that can lead to unconditional arbitrary command execution. It can cooperate with CVE-2021-44971 to achieve this. The vulnerability is reported within Red Hat/RedHat-derived advisori...

CVE-2021-44971: Incorrect Comparison

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20multi?AC5V1.0 Firmware V15.03.06.48multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE...