Vendor
Tenda vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 327 vulnerabilities in Tenda: 1 in the last 7 days and 31 in the last 90 days, 39 of them critical and 3 exploited in the wild. The most recent, CVE-2026-123966, was published on 7 November 2026. 5 vulnerabilities in the last four weeks, level on the four before (5). 3 critical against 3. 67 technologies have a page of their own.
- Last 7 days
- 1
- Last 90 days
- 31
- Critical, all time
- 39
- Exploited in the wild
- 3
About Tenda
A manufacturer of networking devices and equipment.
Tenda technologies
- Tenda CH2224
- Tenda F45623
- Tenda F456 Firmware22
- Tenda Ch22 Firmware20
- Tenda Wh45019
- Tenda Wh450 Firmware19
- Tenda F45117
- Tenda CP314
- Tenda F451 Firmware14
- Tenda AC713
- Tenda O311
- Tenda W20E11
- Tenda G010
- Tenda HG1010
- Tenda W15E10
- Tenda AC109
- Tenda AC10 Firmware8
- Tenda AC68
- Tenda AC6 firmware8
- Tenda Ac7 Firmware8
- Tenda W3 Wireless Router8
- Tenda AC87
- Tenda Ac8 Firmware7
- Tenda CX12L7
- Tenda CX12L Firmware7
- Tenda W127
- Tenda 5G036
- Tenda BE12 Pro6
- Tenda F36
- Tenda M36
- Tenda M3 Firmware6
- Tenda O3 Firmware1.0.0.10\(2478\)6
- Tenda AC12065
- Tenda AC155
- Tenda AC185
- Tenda Ac235
- Tenda Ac23 Firmware5
- Tenda Ac95
- Tenda CP3 V3.0 firmware5
- Tenda F3 Firmware5
- Tenda JD12L Pro5
- Tenda TX9 Pro5
- Tenda AC15 firmware4
- Tenda Ac204
- Tenda Ac20 Firmware4
- Tenda AC8V44
- Tenda CX12L Router4
- Tenda F12024
- Tenda Hg34
- Tenda Hg3 Firmware4
- Tenda Ac18 Firmware3
- Tenda Ac213
- Tenda Ac21 Firmware3
- Tenda Ac9 Firmware3
- Tenda CH103
- Tenda CH73
- Tenda CH7G3
- Tenda CP3 Pro3
- Tenda CP73
- Tenda FH1201 firmware3
- Tenda HG73
- Tenda HG93
- Tenda PW201A3
- Tenda TC3B14C3
- Tenda TC3B15C3
- Tenda TC3T14C3
- Tenda TC3T15C3
Latest Tenda vulnerabilities
- CVE-2026-123966: Tenda AC19 heap buffer overflow in saveParentControlInfocriticalCVSS 10
- CVE-2026-118238: Tenda W18E command injection in web management diagnose featureinfo
- CVE-2026-115796: Tenda F6 cross-site request forgery in web management interfacemediumCVSS 4.3
- CVE-2026-114268: Tenda BE3L Pro buffer overflow in WifiBasicSetcriticalCVSS 9.9
- CVE-2026-113744: Tenda AC19 stack buffer overflow in firewall configurationcriticalCVSS 10
- CVE-2026-105778: Tenda AC5 stack-based buffer overflow in WiFi handlercriticalCVSS 9.9
- CVE-2026-104611: Tenda AC9 stack buffer overflow in POST request handlercriticalCVSS 9.1EPSS 0.5%
- CVE-2026-104610: Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBackcriticalCVSS 10EPSS 0.6%
- CVE-2026-90689: Tenda W20E stack buffer overflow in formDelWebAuthWhiteUserhighCVSS 8.8EPSS 0.9%
- CVE-2026-90688: Tenda W20E stack buffer overflow in formIPMacBindAddmediumCVSS 6.5EPSS 0.7%
- CVE-2026-86300: Tenda AC9 authentication bypass in web managementhighCVSS 7.3EPSS 0.8%
- CVE-2026-86167: Tenda HG10 OS command injection in formgponConfcriticalCVSS 9.9EPSS 2.7%
- CVE-2026-86166: Tenda HG10 buffer overflow in formWanRedirecthighCVSS 8.8EPSS 0.9%
- CVE-2026-86165: Tenda HG10 buffer overflow in formURLcriticalCVSS 9.8EPSS 1.1%
- CVE-2026-86153: Tenda CP3 privilege escalation in redirect servercriticalCVSS 9.1EPSS 0.7%
- CVE-2026-86152: Tenda CP3 OS command injection in AutoAddWificriticalCVSS 10EPSS 2.9%
- CVE-2026-86151: Tenda CP3 OS command injection in Network Configuration ManagementcriticalCVSS 9.1EPSS 2.9%
- CVE-2026-86150: Tenda CP3 hard-coded credentials in hostapd configurationmediumCVSS 4.1EPSS 0.4%
- CVE-2026-86149: Tenda CP3 OS command injection via interface_name argumentcriticalCVSS 9.1EPSS 2.9%
- CVE-2026-86148: Tenda CP3 OS command injection in SystemAshcriticalCVSS 9.1EPSS 2.9%
- CVE-2026-85110: Tenda HG10 buffer overflow in formWlanSetup SSID parameterhighCVSS 8.8EPSS 0.9%
- CVE-2026-85109: Tenda HG10 buffer overflow in Boa Web Server login handlercriticalCVSS 9.8EPSS 1.1%
- CVE-2026-51934: Tenda A18 buffer overflow in fromSetCmdlineRuncriticalCVSS 9.8EPSS 1.1%
- CVE-2026-38577: Tenda HG21 hardcoded credentials in admin accountcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-82695: Tenda AC18 authentication bypass in telnet handlercriticalCVSS 10EPSS 1.4%
Most severe Tenda vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2021-31755: Tenda AC11 Router Stack Buffer Overflow Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2026-86152: Tenda CP3 OS command injection in AutoAddWificriticalCVSS 10EPSS 2.9%
- CVE-2026-82694: Tenda AC1206 authentication bypass in Web UIcriticalCVSS 10EPSS 1.4%
- CVE-2026-82693: Tenda AC1206 authentication bypass in web UI telnet functioncriticalCVSS 10EPSS 1.4%
- CVE-2026-82695: Tenda AC18 authentication bypass in telnet handlercriticalCVSS 10EPSS 1.4%
- CVE-2026-82542: Tenda HG10 buffer overflow in formIPv6RoutingcriticalCVSS 10EPSS 1.1%
- CVE-2026-104610: Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBackcriticalCVSS 10EPSS 0.6%
- CVE-2026-123966: Tenda AC19 heap buffer overflow in saveParentControlInfocriticalCVSS 10
Vulnerabilities per week
5 vulnerabilities in the last four weeks, level on the four before (5). 3 critical against 3. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 0 | |
| 24 Aug 2026 | 1 | 1 | |
| 31 Aug 2026 | 16 | 13 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 2 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 2 | 2 | |
| 5 Oct 2026 | 1 | 1 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 3 | 2 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 1 | 1 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Tenda vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/tenda)<a href="https://junglewise.ai/threats/vendors/tenda"><img src="https://junglewise.ai/threats/vendors/tenda/badge.svg" alt="Tenda vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/tenda.json, and this page as text at https://junglewise.ai/threats/vendors/tenda.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Tenda vulnerabilities", https://junglewise.ai/threats/vendors/tenda, 13 November 2026.