A flaw has been found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Destination Handler. Executing a manipulation of the argument policyType can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
A vulnerability was identified in Tenda AC10 16.03.10.10_multi_TDE01. This affects the function fromSysToolChangePwd of the file /bin/httpd. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. Multiple endpoints might be affected.
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key
. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this vulnerability is the function fromSysToolChangePwd of the file /bin/httpd. Performing a manipulation of the argument sys.userpass results in stack-based buffer overflow. The attack can be initiated remotely.
A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.
A weakness has been identified in Tenda 4G03 Pro 1.0/1.0re/01.bin/04.03.01.53. Affected by this issue is some unknown functionality of the file /etc/www/pem/server.key of the component ECDSA P-256 Private Key Handler. This manipulation causes use of hard-coded cryptographic key
. It is possible to initiate the attack remotely.
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2026-5339 is a medium severity command injection vulnerability in Tenda G103 version 1.0.0.5. The flaw exists in the action_set_net_settings function within the gpon.lua file of the Setting Handler component. Remote attackers can manipulate certain arguments (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) to inject commands. The vulnerability is remotely exploitable and a public exploit is available. No patch or official remediation information is provided at this time.
CVE-2026-5338 is a medium severity command injection vulnerability in Tenda G103 version 1.0.0.5. It affects the function action_set_system_settings in the system.lua file within the Setting Handler component. The vulnerability arises from improper handling of the lanIp argument, allowing remote attackers to inject commands. The exploit has been publicly disclosed but there are no known exploits in the wild at this time. No patch or official remediation information is provided in the available data.
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5156 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1. It affects the formQuickIndex function in the /goform/QuickIndex component, where manipulation of the mit_linktype argument can trigger the overflow. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 8.7. Although the exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No patch or official remediation information is currently available.
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2026-5154 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 versions 1.0.0.1 and 1. If. It arises from improper handling of the 'funcname' argument in the fromSetCfm function within the /goform/setcfm component. This flaw allows remote attackers to potentially execute arbitrary code without user interaction. The vulnerability has been publicly disclosed, but no known exploits are currently observed in the wild. No official patch or remediation information is provided at this time.
CVE-2026-5153 is a command injection vulnerability in Tenda CH22 version 1.0.0.1. The flaw exists in the FormWriteFacMac function within the /goform/WriteFacMac file, where manipulation of the 'mac' argument can lead to remote command injection. The vulnerability has a medium severity with a CVSS score of 5.3. Although an exploit has been published, there are no known exploits in the wild at this time. No patch or official remediation information is currently available.
CVE-2026-5152 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1. It affects the function formCreateFileName in the /goform/createFileName file, where manipulation of the fileNameMit argument can trigger the overflow. The vulnerability can be exploited remotely without user interaction. Although the exploit code is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-5046 is a high-severity stack-based buffer overflow vulnerability in the Tenda FH1201 router firmware version 1.2.0.14(408). The flaw exists in the formWrlExtraSet function of the /goform/WrlExtraSet component, where manipulation of the GO argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction or privileges. Although an exploit has been published, there are no known exploits observed in the wild yet. No official patch or remediation information is currently available.
A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
