Vulnerabilities > Tenda
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-05-07 | CVE-2021-31757 | Out-of-bounds Write vulnerability in Tenda Ac11 Firmware An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. | 10.0 |
| 2021-05-07 | CVE-2021-31758 | Out-of-bounds Write vulnerability in Tenda Ac11 Firmware An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. | 10.0 |
| 2021-01-26 | CVE-2021-3186 | Cross-site Scripting vulnerability in Tenda Ac1200 Firmware 15.03.06.47Multi A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter. | 4.3 |
| 2021-01-01 | CVE-2020-35391 | Forced Browsing vulnerability in Tenda F3 Firmware 12.01.01.48 Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. | 6.5 |
| 2020-12-30 | CVE-2020-28095 | Infinite Loop vulnerability in Tenda Ac1200 Firmware 15.03.06.51Multi On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop. | 7.8 |
| 2020-07-23 | CVE-2020-15916 | OS Command Injection vulnerability in Tenda Ac15 Firmware 15.03.05.19 goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter. | 10.0 |
| 2020-07-13 | CVE-2020-10989 | Cross-site Scripting vulnerability in Tenda Ac15 Firmware 15.03.05.19 An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter. | 4.3 |
| 2020-07-13 | CVE-2020-10988 | Use of Hard-coded Credentials vulnerability in Tenda Ac15 Firmware 15.03.05.19 A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device. | 10.0 |
| 2020-07-13 | CVE-2020-10987 | Injection vulnerability in Tenda Ac15 Firmware 15.03.05.19 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. | 10.0 |
| 2020-07-13 | CVE-2020-10986 | Cross-Site Request Forgery (CSRF) vulnerability in Tenda Ac15 Firmware 15.03.05.19 A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page. | 7.1 |