Threat database

A vulnerability was determined in Tenda F1202 1.2.0.20(408). Affected by this issue is the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Executing a manipulation of the argument dips can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-9429 is a high-severity stack-based buffer overflow vulnerability in the Tenda F1202 router firmware version 1.2.0.20(408). The flaw exists in the formWrlExtraSet function within the /goform/WrlExtraSet endpoint, where manipulation of the delno argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-8265 is a medium severity OS command injection vulnerability in the Tenda AC6 router firmware version 15.03.06.23. It affects the get_log_file function in the /goform/getLogFile endpoint of the httpd component. The vulnerability arises from improper handling of the wans.flag argument, allowing remote attackers to inject operating system commands. The exploit has been publicly disclosed but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

CVE-2026-8264 is an OS command injection vulnerability in the Tenda AC6 router firmware version 15.03.06.23. The flaw exists in the formWifiApScan function within the /goform/WifiApScan component of the httpd service. Manipulating the wl2g.public.country or wl5g.public.country arguments remotely can lead to command injection.

CVE-2026-8263 is a medium severity OS command injection vulnerability in the Tenda AC6 router firmware version 15.03.06.49_multi_TDE01. The flaw exists in the fromSetWirelessRepeat function within the /goform/WifiExtraSet component of the httpd service. An attacker can remotely manipulate the mac or ssid parameters to execute arbitrary OS commands. Although an exploit has been publicly released, there is no official patch or remediation guidance available at this time.

CVE-2026-8259 is a medium severity OS command injection vulnerability in the Tenda AC6 router firmware version 2.0/15.03.06.23. The flaw exists in an unknown function within the /goform/telnet component of the httpd service, where manipulation of the lan.ip argument can lead to command injection. This vulnerability can be exploited remotely without user interaction and requires high privileges. Although an exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided yet.

CVE-2026-8138 is a high-severity stack-based buffer overflow vulnerability in the Tenda CX12L router firmware version 16.03.53.12. The flaw exists in the formSetPPTPServer function within the /goform/SetPptpServerCfg file and can be triggered remotely without user interaction. Exploit code has been publicly disclosed, increasing the risk of potential attacks. No official patch or remediation guidance has been provided by the vendor as of the publication date.

A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation of the argument delflag results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-7160 is a command injection vulnerability in Tenda HG3 version 2.0 affecting the formTracert function in the /boaform/formTracert file. An attacker can manipulate the 'datasize' argument remotely to execute arbitrary commands on the device. The vulnerability has a high severity with a CVSS score of 8.7 and has been publicly disclosed. No official patch or remediation guidance is currently available from the vendor. Exploits are not known to be in the wild at this time.

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability has been found in Tenda F456 1.0.0.5. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

A flaw has been found in Tenda F456 1.0.0.5. The impacted element is the function fromNatlimitof of the file /goform/Natlimit of the component httpd. Executing a manipulation can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in Tenda F456 1.0.0.5. The affected element is the function formQuickIndex of the file /goform/QuickIndex of the component httpd. Performing a manipulation of the argument mit_linktype results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.