Tenda Ac15 Firmware vulnerabilities

CVE-2025-25632 [CRITICAL] CWE-77 CVE-2025-25632: Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telne Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.

CVE-2025-63666 [CRITICAL] CWE-284 CVE-2025-63666: Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password has Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.

CVE-2021-44971 [CRITICAL] CWE-697 CVE-2021-44971: Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20 Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE.

CVE-2022-37175 [CRITICAL] CWE-787 CVE-2022-37175: Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet.

CVE-2023-30373 [CRITICAL] CWE-787 CVE-2023-30373: In Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vu In Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.

CVE-2023-30372 [CRITICAL] CWE-787 CVE-2023-30372: In Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnera In Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.

CVE-2023-30370 [CRITICAL] CWE-787 CVE-2023-30370: In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerabili In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.

CVE-2023-30371 [CRITICAL] CWE-787 CVE-2023-30371: In Tenda AC15 V15.03.05.19, the function "sub_ED14" contains a stack-based buffer overflow vulnerabi In Tenda AC15 V15.03.05.19, the function "sub_ED14" contains a stack-based buffer overflow vulnerability.

CVE-2023-30376 [CRITICAL] CWE-787 CVE-2023-30376: In Tenda AC15 V15.03.05.19, the function "henan_pppoe_user" contains a stack-based buffer overflow v In Tenda AC15 V15.03.05.19, the function "henan_pppoe_user" contains a stack-based buffer overflow vulnerability.

CVE-2023-30378 [CRITICAL] CWE-787 CVE-2023-30378: In Tenda AC15 V15.03.05.19, the function "sub_8EE8" contains a stack-based buffer overflow vulnerabi In Tenda AC15 V15.03.05.19, the function "sub_8EE8" contains a stack-based buffer overflow vulnerability.

CVE-2023-30375 [CRITICAL] CWE-787 CVE-2023-30375: In Tenda AC15 V15.03.05.19, the function "getIfIp" contains a stack-based buffer overflow vulnerabil In Tenda AC15 V15.03.05.19, the function "getIfIp" contains a stack-based buffer overflow vulnerability.

CVE-2017-16923 [HIGH] CWE-78 CVE-2017-16923: Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_m Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01, Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01, Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01, and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticate

CVE-2025-29462 [CRITICAL] CWE-120 CVE-2025-29462: A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability oc A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.

CVE-2026-24103 [CRITICAL] CWE-120 CVE-2026-24103: A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.0 A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.

CVE-2018-18728 [CRITICAL] CWE-78 CVE-2018-18728: An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05 An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.

CVE-2023-30369 [CRITICAL] CWE-787 CVE-2023-30369: Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow. Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow.

CVE-2023-39673 [CRITICAL] CWE-120 CVE-2023-39673: Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the functi Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the function FUN_00010e34().

CVE-2018-18729 [CRITICAL] CWE-787 CVE-2018-18729: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_C An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request, the value is directly used in a strcpy

CVE-2024-30645 [HIGH] CWE-78 CVE-2024-30645: Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter. Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.

CVE-2025-55564 [HIGH] CWE-121 CVE-2025-55564: Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBi Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.