20976 matches found
PT-2026-7012
Name of the Vulnerable Software and Affected Versions Tenda RX3 version 16.03.13.11 Description A stack-based buffer overflow exists in Tenda RX3 version 16.03.13.11. The issue is located in the file /goform/fast setting wifi set. Manipulation of the ssid 5g argument can trigger the overflow. Thi...
Tenda RX3 安全漏洞
The Tenda RX3 is a dual-band WiFi 6 home router produced by the Chinese company Tenda. It is used for network coverage in households and supports high-speed wireless connections. The version 16.03.13.11 of the Tenda RX3 contains a security vulnerability. This vulnerability stems from incorrect...
PT-2026-6964
Name of the Vulnerable Software and Affected Versions Tenda TX9 versions up to 22.03.02.10 multi Description A flaw exists in Tenda TX9 devices up to version 22.03.02.10 multi. The issue is due to a buffer overflow in the sub 42D03C function within the /goform/SetStaticRouteCfg file when handling...
PT-2026-6985
Name of the Vulnerable Software and Affected Versions Tenda AC8 version 16.03.33.05 Description A buffer overflow issue exists in the fromSetWifiGusetBasic function within the /goform/WifiGuestSet file of the httpd component. The shareSpeed argument can be manipulated to trigger this issue,...
PT-2026-6986
Name of the Vulnerable Software and Affected Versions Tenda AC8 version 16.03.33.05 Description A buffer overflow issue exists in the Embedded Httpd Service component of Tenda AC8. The flaw is located in the file '/goform/fast setting wifi set' and is triggered by manipulating the timeZone...
PT-2026-6967
Name of the Vulnerable Software and Affected Versions Tenda TX9 versions up to 22.03.02.10 multi Description A flaw exists in the Tenda TX9 device, specifically within the sub 4223E0 function located in the /goform/setMacFilterCfg file. Manipulation of the deviceList argument can trigger a buffer...
CVE-2026-25857
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...
CVE-2026-25857
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...
CVE-2026-25857 Tenda G300-F Command Injection via formSetWanDiag
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...
CVE-2026-25857 Tenda G300-F Command Injection via formSetWanDiag
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...
CVE-2026-25857
CVE-2026-25857 affects the Tenda G300-F router. Affected firmware: versions prior to 16.01.14.2. The issue lies in the WAN diagnostic function formSetWanDiag, which builds a shell command invoking curl and injects attacker-controlled input without proper sanitization. This allows a remote attacke...
CVE-2026-25857
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...
PT-2026-6932
Name of the Vulnerable Software and Affected Versions Tenda G300-F router firmware versions prior to 16.01.14.2 Description The Tenda G300-F router firmware contains an OS command injection issue in the WAN diagnostic functionality, specifically within the formSetWanDiag function. The software...
Tenda G300-F 操作系统命令注入漏洞
The Tenda G300-F is a VPN router produced by the Chinese company Tenda. Versions of the Tenda G300-F starting from 16.01.14.2 and earlier have a vulnerability related to operating system command injection. This vulnerability stems from the presence of OS command injection in the WAN diagnostic...
Tenda D301 and Tenda D151 Access Control Error Vulnerabilities
Tenda D301 is a wireless router.Tenda D151 is a wireless router. An access control error vulnerability exists in the Tenda D301 and Tenda D151 that stems from the presence of an unauthenticated configuration download on the /goform/getimage endpoint, which can be exploited by an attacker to cause...
CVE-2026-24434
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior does not implement CSRF protections for administrative functions in the web management interface. The interface does not enforce anti-CSRF tokens or robust origin validation, which can allow an attacker to induce a logged-in administrat...
CVE-2026-24426
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied input is reflected in HTTP responses without adequate escaping, allowing injection of arbitrary HTML or JavaScript in a victim’s browser...
CVE-2026-24427
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior expose sensitive information in web management responses. Administrative credentials, including the router and/or admin panel password, are included in plaintext within configuration response bodies. In addition, responses lack...
CVE-2026-24441
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to obtain sensitive authentication material...