A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-4905 is a high-severity stack-based buffer overflow vulnerability in the Tenda AC5 router firmware version 15.03.06.47. The flaw exists in the formWifiWpsOOB function within the POST Request Handler component, where manipulation of the 'index' argument can trigger the overflow. This vulnerability allows remote attackers to potentially execute arbitrary code or cause a denial of service. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available from the vendor.
A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-4903 is a high-severity stack-based buffer overflow vulnerability in the Tenda AC5 router firmware version 15.03.06.47. The flaw exists in the formQuickIndex function within the /goform/QuickIndex POST request handler, where manipulation of the PPPOEPassword argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although an exploit has been published, there are no known exploits in the wild at this time. No patch or official remediation information is currently available.
CVE-2026-4902 is a high-severity stack-based buffer overflow vulnerability in the Tenda AC5 router firmware version 15.03.06.47. It affects the fromAddressNat function in the /goform/addressNat POST request handler. The vulnerability arises from improper handling of the 'page' argument, allowing remote attackers to cause a buffer overflow. Exploits for this vulnerability are publicly available. No official patch or remediation information is provided in the available data.
A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4553 is a high-severity stack-based buffer overflow vulnerability in the Tenda F453 router firmware version 1.0.0.3. The flaw exists in the fromNatlimit function within the /goform/Natlimit component, where improper handling of the 'page' argument allows remote attackers to overflow the stack. Exploitation requires no user interaction or privileges and can be initiated remotely over the network. Although no known exploits are currently observed in the wild, a public exploit is available, increasing the risk of attacks. Successful exploitation could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the device and potentially the network it protects. Organizations using Tenda F453 routers should prioritize patching or mitigating this vulnerability. Countries with significant deployments of Tenda networking equipment, especially in Asia and emerging markets, are at higher risk.
CVE-2026-4552 is a high-severity stack-based buffer overflow vulnerability found in Tenda F453 router firmware version 1.0.0.3. It affects the fromVirtualSer function within the /goform/VirtualSer component, specifically the Parameters Handler. An attacker can remotely exploit this vulnerability by manipulating the 'page' argument, leading to a stack-based buffer overflow without requiring user interaction or prior authentication. Although no public exploits are currently observed in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Successful exploitation could allow remote code execution or denial of service, severely impacting device confidentiality, integrity, and availability. Organizations using Tenda F453 routers with the affected firmware are at risk, particularly in environments where these devices are exposed to untrusted networks. Mitigation requires applying firmware updates once available or implementing network-level protections to restrict access to the vulnerable interface.
CVE-2026-4551 is a high-severity stack-based buffer overflow vulnerability affecting Tenda F453 routers running firmware version 1.0.0.3. The flaw exists in the fromSafeClientFilter function within the /goform/SafeClientFilter component, where manipulation of the 'menufacturer/Go' argument can trigger the overflow. This vulnerability can be exploited remotely without authentication or user interaction, enabling attackers to potentially execute arbitrary code or cause denial of service. Although no public exploit is currently observed in the wild, a proof-of-concept exploit has been made public, increasing the risk of exploitation. The vulnerability impacts confidentiality, integrity, and availability due to the possibility of full system compromise. Organizations using affected Tenda F453 devices should prioritize patching or mitigating this issue. Countries with significant deployment of Tenda networking equipment, especially in Asia and emerging markets, are at higher risk.
A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-4534 is a high-severity stack-based buffer overflow vulnerability found in Tenda FH451 version 1.0.0.9. The flaw exists in the formWrlExtraSet function within the /goform/WrlExtraSet endpoint, where improper handling of the GO argument allows remote attackers to overflow the stack. This vulnerability requires no user interaction and can be exploited remotely with low attack complexity. Successful exploitation could lead to full compromise of the affected device, impacting confidentiality, integrity, and availability. Although no known exploits are currently observed in the wild, a public exploit has been published, increasing the risk of active attacks. Organizations using Tenda FH451 routers should prioritize patching or apply mitigations to prevent exploitation. Countries with significant deployments of Tenda networking equipment, especially in Asia and parts of Europe, are at higher risk.
A vulnerability was determined in Tenda A18 Pro 02.03.02.28. The impacted element is the function sub_423B50 of the file /goform/setMacFilterCfg of the component MAC Filtering Configuration Endpoint. Executing a manipulation of the argument deviceList can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-4492 is a high-severity stack-based buffer overflow vulnerability in the Tenda A18 Pro router firmware version 02.03.02.28. The flaw exists in the set_qosMib_list function within the /goform/formSetQosBand endpoint, where improper handling of argument lists allows remote attackers to trigger a buffer overflow. Exploitation does not require user interaction or privileges and can be performed over the network, potentially leading to remote code execution with high impact on confidentiality, integrity, and availability. Although no public exploits are currently observed in the wild, proof-of-concept code has been disclosed. Organizations using this router model are at risk of compromise if unpatched. Immediate mitigation involves firmware updates or network-level protections to restrict access to the vulnerable interface.
A vulnerability has been found in Tenda A18 Pro 02.03.02.28. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-4490 is a high-severity stack-based buffer overflow vulnerability found in the Tenda A18 Pro router firmware version 02.03.02.28. The flaw exists in the setSchedWifi function within the /goform/openSchedWifi endpoint, allowing remote attackers to trigger a buffer overflow without authentication or user interaction. Exploitation can lead to full compromise of the device, including arbitrary code execution with elevated privileges. Although no public exploits are currently observed in the wild, proof-of-concept code has been published, increasing the risk of active exploitation. The vulnerability affects the confidentiality, integrity, and availability of affected devices and potentially the networks they serve. Organizations using Tenda A18 Pro routers should prioritize patching or mitigating this issue to prevent remote takeover. Countries with significant deployment of Tenda networking equipment and strategic interest in network infrastructure are at higher risk.
