EUVD-2026-91579

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...

CVE-2026-104611

A stack-based buffer overflow vulnerability exists in the Tenda AC9 (version 15.03.02.13). The flaw is located within an unknown function in the /goform/fast_setting_internet_set file of the POST Request Handler component. By manipulating the netWanType argument, an attacker can trigger the overf...

CVE-2026-38142: Improper Neutralization of Special Elements used in a Command

An unauthenticated command injection vulnerability in the /goform/fastsettinginternetset endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into the mac parameter...

EUVD-2022-47968

Malicious code in bioql PyPI...

Command injection

Tenda AX12 V22.03.01.16cn is vulnerable to command injection via goform/fastsettinginternetset...

CVE-2022-45043: Improper Neutralization of Special Elements used in an OS Command

Tenda AX12 V22.03.01.16cn is vulnerable to command injection via goform/fastsettinginternetset...