Tenda Ac18 Firmware vulnerabilities

CVE-2024-28537 [CRITICAL] CWE-125 CVE-2024-28537: Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSet Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.

CVE-2022-35201 [CRITICAL] CVE-2022-35201: Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability. Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.

CVE-2022-38310 [CRITICAL] CWE-787 CVE-2022-38310: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the l Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.

CVE-2022-38311 [CRITICAL] CWE-787 CVE-2022-38311: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the t Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet.

CVE-2022-38313 [CRITICAL] CWE-787 CVE-2022-38313: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the t Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/saveParentControlInfo.

CVE-2022-38309 [CRITICAL] CWE-787 CVE-2022-38309: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the l Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.

CVE-2022-38314 [CRITICAL] CWE-787 CVE-2022-38314: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the u Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the urls parameter at /goform/saveParentControlInfo.

CVE-2022-38312 [CRITICAL] CWE-787 CVE-2022-38312: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the l Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.

CVE-2022-43260 [CRITICAL] CWE-787 CVE-2022-43260: Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in t Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function.

CVE-2025-0528 [HIGH] CWE-74 CVE-2025-0528: A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03. A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and

CVE-2022-30472 [CRITICAL] CWE-787 CVE-2022-30472: Tenda AC Seris Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in fun Tenda AC Seris Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function fromAddressNat

CVE-2022-40854 [CRITICAL] CWE-787 CVE-2022-40854: Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set

CVE-2022-30476 [CRITICAL] CWE-787 CVE-2022-30476: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overfl Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetFirewallCfg request.

CVE-2022-30477 [CRITICAL] CWE-787 CVE-2022-30477: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overfl Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetClientState request.

CVE-2017-16923 [HIGH] CWE-78 CVE-2017-16923: Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_m Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01, Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01, Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01, and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticate

CVE-2018-18728 [CRITICAL] CWE-78 CVE-2018-18728: An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05 An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.

CVE-2022-30474 [CRITICAL] CWE-787 CVE-2022-30474: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a heap overflow in the http Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a heap overflow in the httpd module when handling /goform/saveParentControlInfo request.

CVE-2023-24166 [CRITICAL] CWE-787 CVE-2023-24166: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet. Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet.

CVE-2023-24165 [CRITICAL] CWE-787 CVE-2023-24165: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo. Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.

CVE-2023-24169 [CRITICAL] CWE-787 CVE-2023-24169: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c. Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c.