Tenda Ac18 vulnerabilities

CVE-2025-5607 [HIGH] CWE-119 CVE-2025-5607: A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affec A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-11123 [HIGH] CWE-119 CVE-2025-11123: A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /gofor A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.

CVE-2024-2546 [HIGH] CWE-121 CVE-2024-2546: A vulnerability has been found in Tenda AC18 15.13.07.09 and classified as critical. Affected by thi A vulnerability has been found in Tenda AC18 15.13.07.09 and classified as critical. Affected by this vulnerability is the function fromSetWirelessRepeat. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated

CVE-2025-5609 [HIGH] CWE-119 CVE-2025-5609: A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnera A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-9023 [HIGH] CWE-119 CVE-2025-9023: A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the functi A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-5608 [HIGH] CWE-119 CVE-2025-5608: A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the fun A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-0528 [HIGH] CWE-74 CVE-2025-0528: A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03. A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and

CVE-2025-8182 [HIGH] CWE-521 CVE-2025-8182: A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnera A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficu

CVE-2024-10280 [HIGH] CWE-476 CVE-2024-10280: A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit

CVE-2024-2559 [MEDIUM] CWE-352 CVE-2024-2559: A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257058 is the identifier a

CVE-2024-2560 [MEDIUM] CWE-352 CVE-2024-2560: A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vuln A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associate