A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-6016 is a high-severity stack-based buffer overflow vulnerability in the Tenda AC9 router firmware version 15.03.02.13. The flaw exists in the decodePwd function within the /goform/WizardHandle POST request handler, where manipulation of the WANS argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Although an exploit has been publicly disclosed, there is no confirmed patch or official remediation available at this time.
A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was determined in Tenda F451 1.0.0.7. This affects the function fromP2pListFilter of the file /goform/P2pListFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in Tenda F451 1.0.0.7. Affected by this issue is the function formWrlExtraSet of the file /goform/WrlExtraSet. The manipulation of the argument GO results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
CVE-2026-5990 is a stack-based buffer overflow vulnerability in the Tenda F451 router firmware version 1.0.0.7. The flaw exists in the fromSafeEmailFilter function within the /goform/SafeEmailFilter component, where improper handling of the 'page' argument can lead to memory corruption. This vulnerability can be exploited remotely without user interaction or privileges. Although the exploit code has been publicly disclosed, there is no confirmed patch or official remediation available at this time.
A flaw has been found in Tenda F451 1.0.0.7. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-5849 is a path traversal vulnerability in the HTTP Handler component of Tenda i12 version 1.0.0.11(3862). This vulnerability allows remote attackers to manipulate the system to access files outside the intended directory structure. The vulnerability has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-5841 is a path traversal vulnerability in the Tenda i3 device version 1.0.0.6(2204), specifically in the R7WebsSecurityHandler function of the HTTP Handler component. This vulnerability can be exploited remotely without authentication or user interaction. The exploit code is publicly available, increasing the risk of potential attacks. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-5830 is a high-severity stack-based buffer overflow vulnerability in the Tenda AC15 router firmware version 15.03.05.18. The flaw exists in the websGetVar function within the /goform/SysToolChangePwd file, where manipulation of the oldPwd, newPwd, or cfmPwd parameters can trigger the overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity with no privileges needed. Although an exploit is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the published date.
A stack-based buffer overflow vulnerability exists in the Tenda CX12L router firmware version 16.03.53.12, specifically in the fromNatStaticSetting function handling the /goform/NatStaticSetting endpoint. This flaw can be triggered remotely by manipulating the 'page' argument, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a high severity rating with a CVSS score of 8.7. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
CVE-2026-5686 is a high-severity stack-based buffer overflow vulnerability in the Tenda CX12L router firmware version 16.03.53.12. The flaw exists in the fromRouteStatic function within the /goform/RouteStatic file, where improper handling of the 'page' argument allows remote attackers to cause a buffer overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although an exploit has been publicly released, there is no official patch or remediation guidance available from the vendor at this time.
CVE-2026-5685 is a high-severity stack-based buffer overflow vulnerability in the Tenda CX12L router firmware version 16.03.53.12. It occurs in the fromAddressNat function within the /goform/addressNat file due to improper handling of the 'page' argument. This vulnerability can be exploited remotely without user interaction and has a CVSS 4.0 base score of 8.7. Although an exploit is publicly available, there is no confirmed information about active exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-5684 is a high-severity stack-based buffer overflow vulnerability in the Tenda CX12L router firmware version 16.03.53.12. The flaw exists in the function fromwebExcptypemanFilter within the /goform/webExcptypemanFilter file. Exploitation requires local network access and involves manipulating the 'page' argument to trigger the overflow. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-5683 is a medium severity stack-based buffer overflow vulnerability in the Tenda CX12L router firmware version 16.03.53.12. It occurs in the fromP2pListFilter function of the /goform/P2pListFilter file when the page argument is manipulated. Exploitation requires local network access. No official patch or remediation guidance is currently available. The vulnerability has a CVSS 4.0 base score of 5.1.
CVE-2026-5609 is a high-severity stack-based buffer overflow vulnerability in Tenda i12 version 1.0.0.11(3862). The flaw exists in the formwrlSSIDset function within the /goform/wifiSSIDset component's Parameter Handler. This vulnerability can be triggered remotely by manipulating the index/wl_radio argument, potentially leading to memory corruption. An exploit has been published, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-5605 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1. It affects the function formWrlExtraSet in the /goform/WrlExtraSet file, where manipulation of the GO argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although an exploit is publicly available, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided yet.
CVE-2026-5604 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1. The flaw exists in the function formCertLocalPrecreate within the /goform/CertLocalPrecreate component's Parameter Handler. It can be triggered remotely by manipulating the argument 'standard', potentially allowing an attacker to execute arbitrary code or cause a denial of service. Although an exploit has been publicly released, there is no confirmed patch or official remediation available at this time.