Threat database

CVE-2026-115797 is a vulnerability in the Tenda F6 router's Web Management Interface version 12.02.01.73. It involves cleartext transmission of sensitive information due to manipulation of the ecos_pw argument. The vulnerability can be exploited remotely but requires high complexity and is considered difficult to exploit. No patch information is provided. The CVSS score is 6.3, indicating a medium severity risk.

CVE-2026-115796 is a medium severity cross-site request forgery (CSRF) vulnerability in the Web Management Interface of Tenda F6 router firmware version 12.02.01.73. The flaw allows remote attackers to perform unauthorized actions via crafted requests. Exploit code has been publicly released. No patch or remediation information is currently available.

CVE-2026-114268 is a critical buffer overflow vulnerability in the Tenda BE3L Pro router firmware version 16.03.60.62. The flaw exists in the formWifiBasicSet function within the /goform/WifiBasicSet file, where improper handling of the security_5g argument allows remote attackers to cause a buffer overflow. Exploit code has been published, increasing the risk of exploitation. No patch information is currently available.

CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service component, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.

A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.

A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.

CVE-2026-86300 is a medium severity vulnerability in the Tenda AC9 router firmware version 15.03.05.14. It affects the Web Management component's R7WebsSecurityHandler function, causing improper authentication. This flaw can be exploited remotely without authentication or user interaction. An exploit has been published, but there are no known reports of active exploitation in the wild. No patch or official remediation information is currently available.

CVE-2026-86167 is a critical OS command injection vulnerability in the Tenda HG10 device. It affects the formgponConf function in the /boaform/admin/formgponConf component. The vulnerability arises from improper handling of the fmgpon_loid argument, allowing remote attackers to execute arbitrary OS commands. Exploit code is publicly available, increasing the risk of exploitation. No patch or remediation information is currently provided by the vendor.

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-86165 is a critical buffer overflow vulnerability in the Tenda HG10 device, specifically in the formURL function of the /boaform/admin/formURL file. The vulnerability is triggered by manipulating the Keywd/urlFQDN argument remotely. An exploit has been publicly disclosed, increasing the risk of exploitation.

CVE-2026-86153 is a critical vulnerability in Tenda CP3 version 27.5.57.101 affecting the function CRedirServer::SetRedirectEnable. It involves improper privilege management that can be exploited remotely without user interaction. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact potential. No patch or vendor advisory details are provided, so remediation status is unknown.

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely.

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.

CVE-2026-86150 is a medium severity vulnerability in Tenda CP3 version 27.5.57.101 involving hard-coded credentials in the file custom-x/softap/hostapd. This flaw allows remote attackers to exploit the manipulation of the wpa_passphrase argument. The vulnerability has been publicly disclosed and may be exploited, but no known exploits are currently active in the wild. No patch or official remediation information is provided.

CVE-2026-86149 is a critical OS command injection vulnerability in Tenda CP3 version 27.5.57.101. The flaw arises from improper handling of the argument interface_name/host in the Net/NetCheckPing.cpp file, allowing remote attackers to execute arbitrary OS commands. This vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. There is no information about available patches or vendor advisories. No known exploits in the wild have been reported.

CVE-2026-86148 is a critical OS command injection vulnerability in Tenda CP3 version 27.5.57.101. The flaw exists in the SystemAsh function of the Apis/system.c file within the Kylin component. An attacker can remotely exploit this by manipulating the AlarmVoiceURL argument to execute arbitrary OS commands.

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.