CVE-2026-86300Tenda AC9 Web Management R7WebsSecurityHandler improper authentication Exploitation status Public exploit Fix Not confirmed Affected product A AC9 Published 09/07/2026 Severity Medium CVE-2026-86167Tenda HG10 Boa formgponConf os command injection Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 09/06/2026 Severity Critical CVE-2026-86166Tenda HG10 Boa Web Server formWanRedirect buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 09/06/2026 Severity High CVE-2026-86165Tenda HG10 formURL buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 09/06/2026 Severity Critical CVE-2026-86153Tenda CP3 Redirect.cpp SetRedirectEnable privileges management Exploitation status Not known exploited Fix Not confirmed Affected product C CP3 Published 09/06/2026 Severity Critical CVE-2026-86152Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection Exploitation status Not known exploited Fix Not confirmed Affected product C CP3 Published 09/06/2026 Severity Critical CVE-2026-86151Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection Exploitation status Public exploit Fix Not confirmed Affected product C CP3 Published 09/05/2026 Severity Critical CVE-2026-86150Tenda CP3 hostapd hard-coded credentials Exploitation status Not known exploited Fix Not confirmed Affected product C CP3 Published 09/05/2026 Severity Medium CVE-2026-86149Tenda CP3 NetCheckPing.cpp os command injection Exploitation status Not known exploited Fix Not confirmed Affected product C CP3 Published 09/05/2026 Severity Critical CVE-2026-86148Tenda CP3 Kylin system.c SystemAsh os command injection Exploitation status Not known exploited Fix Not confirmed Affected product C CP3 Published 09/05/2026 Severity Critical CVE-2026-85110Tenda HG10 Boa Web Server formWlanSetup buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 09/03/2026 Severity High CVE-2026-85109Tenda HG10 Boa Web Server formLogin buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 09/03/2026 Severity Critical CVE-2026-82695Tenda AC18 Telnet telnet missing authentication Exploitation status Public exploit Fix Not confirmed Affected product A AC18 Published 08/31/2026 Severity Critical CVE-2026-82694Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication Exploitation status Public exploit Fix Not confirmed Affected product A AC1206 Published 08/31/2026 Severity Critical CVE-2026-82693Tenda AC1206 Web UI telnet TendaTelnet missing authentication Exploitation status Public exploit Fix Not confirmed Affected product A AC1206 Published 08/31/2026 Severity Critical CVE-2026-82542Tenda HG10 Boa Web Server formIPv6Routing buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG10 Published 08/30/2026 Severity Critical CVE-2026-78141Tenda CH22 exeCommand formexeCommand command injection Exploitation status Public exploit Fix Not confirmed Affected product C CH22 Published 08/23/2026 Severity Medium CVE-2026-78063Tenda CH22 editFileName formeditFileName command injection Exploitation status Public exploit Fix Not confirmed Affected product C CH22 Published 08/23/2026 Severity Medium CVE-2026-77031Tenda CH22 formcreateFileName command injection Exploitation status Public exploit Fix Not confirmed Affected product C CH22 Published 08/20/2026 Severity Medium CVE-2026-19924Tenda AC10 httpd R7WebsSecurityHandler improper authentication Exploitation status Public exploit Fix Not confirmed Affected product A AC10 Published 08/16/2026 Severity Critical CVE-2026-19824Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 08/14/2026 Severity High CVE-2026-19823Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 08/14/2026 Severity High CVE-2026-19822Tenda W20E QoS Edit editQos lstAdd stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 08/14/2026 Severity High CVE-2026-19821Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product A AC12 Published 08/14/2026 Severity High CVE-2026-19792Tenda G0 httpd web management interface module setPortMapping buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product G G0 Published 08/14/2026 Severity High CVE-2026-19791Tenda G0 httpd web management interface module addStaticRoute stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product G G0 Published 08/14/2026 Severity High CVE-2026-19790Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product G G0 Published 08/14/2026 Severity High CVE-2026-19789Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product A AC1206 Published 08/14/2026 Severity High CVE-2026-19788Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product A AC1206 Published 08/14/2026 Severity High CVE-2026-19750Tenda CH/CP/TX3 SSH hard-coded password Exploitation status Public exploit Fix Not confirmed Affected product C CH Published 08/13/2026 Severity Critical CVE-2026-19749Tenda CH7 RTSP/ONVIF missing authentication Exploitation status Public exploit Fix Not confirmed Affected product C CH7 Published 08/13/2026 Severity Medium CVE-2026-19748Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy Exploitation status Public exploit Fix Not confirmed Affected product C CH7 Published 08/13/2026 Severity Medium CVE-2026-19747Tenda CH7 ATE Module Kylin HandleCmd command injection Exploitation status Public exploit Fix Not confirmed Affected product C CH7 Published 08/13/2026 Severity Critical CVE-2026-19346Tenda CH22 CertListInfo formCertListInfo command injection Exploitation status Public exploit Fix Not confirmed Affected product C CH22 Published 08/09/2026 Severity High CVE-2026-16248Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product A AC10 Published 07/20/2026 Severity High CVE-2026-15696Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15695Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15694Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15693Tenda BE12 Pro SafeMacFilter fromSafeMacFilter stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15692Tenda BE12 Pro SafeUrlFilter fromSafeUrlFilter stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15691Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product B BE12 Pro Published 07/14/2026 Severity High CVE-2026-15543Tenda CH22 CertListInfo formCertListInfo buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product C CH22 Published 07/13/2026 Severity High CVE-2026-11405Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface Exploitation status Not known exploited Fix Not confirmed Affected product F firmware Published 07/06/2026 Severity Critical CVE-2026-13519Tenda JD12L NatStaticSetting fromNatStaticSetting stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product J JD12L Published 06/29/2026 Severity High CVE-2026-13518Tenda JD12L addressNat fromAddressNat stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product J JD12L Published 06/29/2026 Severity High CVE-2026-13517Tenda JD12L WifiBasicSet formWifiBasicSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product J JD12L Published 06/29/2026 Severity High CVE-2026-13516Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product J JD12L Published 06/28/2026 Severity High CVE-2026-13515Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product J JD12L Published 06/28/2026 Severity High CVE-2026-11557Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F F451 Published 06/08/2026 Severity High CVE-2026-11556Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection Exploitation status Public exploit Fix Not confirmed Affected product F F451 Published 06/08/2026 Severity High CVE-2026-11553Tenda HG7HG9/HG10 formPPPEdit stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG7HG9 Published 06/08/2026 Severity High CVE-2026-11528Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product A AC18 Published 06/08/2026 Severity High CVE-2026-11524Tenda W20E Web Management modifyWifiFilterRules stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 06/08/2026 Severity High CVE-2026-11523Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 06/08/2026 Severity High CVE-2026-11522Tenda W20E setPortMirror formSetPortMirror stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W20E Published 06/08/2026 Severity High CVE-2026-11504Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product C CX12L Published 06/08/2026 Severity High CVE-2026-11503Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product C CX12L Published 06/08/2026 Severity High CVE-2026-11499Tenda HG7HG9/HG10 formDOMAINBLK stack-based overflow Exploitation status Not known exploited Fix Not confirmed Affected product H HG7HG9 Published 06/08/2026 Severity Critical CVE-2026-11498Tenda HG7HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow Exploitation status Not known exploited Fix Not confirmed Affected product H HG7HG9 Published 06/08/2026 Severity High CVE-2026-11493Tenda AC15 Samba smb.conf weak password Exploitation status Public exploit Fix Not confirmed Affected product A AC15 Published 06/08/2026 Severity Low CVE-2026-10192Tenda W12 httpd set_local_time_0 stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W12 Published 05/31/2026 Severity High CVE-2026-10191Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W12 Published 05/31/2026 Severity High CVE-2026-10190Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service Exploitation status Public exploit Fix Not confirmed Affected product W W12 Published 05/31/2026 Severity High CVE-2026-10189Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W12 Published 05/31/2026 Severity High CVE-2026-10188Tenda W12 httpd cgistaKickOff stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product W W12 Published 05/31/2026 Severity High CVE-2026-9431Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F F1202 Published 05/25/2026 Severity High CVE-2026-9430Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F F1202 Published 05/25/2026 Severity High CVE-2026-9429Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F F1202 Published 05/25/2026 Severity High CVE-2026-9428Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F F1202 Published 05/25/2026 Severity High CVE-2026-9389Tenda F456 L7Im frmL7ImForm buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 05/24/2026 Severity High CVE-2026-8138Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product C CX12L Published 05/08/2026 Severity High CVE-2026-7470Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product 4 4G300 Published 04/30/2026 Severity High CVE-2026-7469Tenda 4G300 DelFil sub_425A28 command injection Exploitation status Public exploit Fix Not confirmed Affected product 4 4G300 Published 04/30/2026 Severity Medium CVE-2018-25318Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change Exploitation status Public exploit Fix Not confirmed Affected product F FH303/A300 Published 04/29/2026 Severity Critical CVE-2018-25317Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change Exploitation status Public exploit Fix Not confirmed Affected product W W3002R Published 04/29/2026 Severity Critical CVE-2018-25316Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change Exploitation status Public exploit Fix Not confirmed Affected product W W308R v2 Published 04/29/2026 Severity Critical CVE-2026-7160Tenda HG3 formTracert command injection Exploitation status Public exploit Fix Not confirmed Affected product H HG3 Published 04/27/2026 Severity High CVE-2026-7151Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product H HG3 Published 04/27/2026 Severity High CVE-2026-7119Tenda HG3 formCountrystr os command injection Exploitation status Public exploit Fix Not confirmed Affected product H HG3 Published 04/27/2026 Severity High CVE-2026-7102Tenda F456 httpd WriteFacMac FromWriteFacMac command injection Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity Medium CVE-2026-7101Tenda F456 httpd WrlclientSet fromWrlclientSet buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7100Tenda F456 httpd Natlimit fromNatlimitof buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7099Tenda F456 httpd QuickIndex formQuickIndex buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7098Tenda F456 httpd DhcpListClient fromDhcpListClient buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7097Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7096Tenda HG3 formgponConf os command injection Exploitation status Public exploit Fix Not confirmed Affected product H HG3 Published 04/27/2026 Severity High CVE-2026-7082Tenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7081Tenda F456 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7080Tenda F456 httpd PPTPUserSetting fromPPTPUserSetting buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7079Tenda F456 httpd AdvSetWan fromAdvSetWan buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7078Tenda F456 httpd SetIpBind fromSetIpBind buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/27/2026 Severity High CVE-2026-7057Tenda F456 httpd setcfm buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High CVE-2026-7056Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High CVE-2026-7055Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High CVE-2026-7054Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High CVE-2026-7053Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High CVE-2026-7036Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal Exploitation status Public exploit Fix Not confirmed Affected product I i9 Published 04/26/2026 Severity Medium CVE-2026-7035Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F FH1202 Published 04/26/2026 Severity High CVE-2026-7034Tenda FH1202 httpd WrlExtraSet stack-based overflow Exploitation status Public exploit Fix Not confirmed Affected product F FH1202 Published 04/26/2026 Severity High CVE-2026-7033Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow Exploitation status Public exploit Fix Not confirmed Affected product F F456 Published 04/26/2026 Severity High