Tenda Ax12 Firmware vulnerabilities

31 known vulnerabilities affecting tenda/ax12_firmware.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL9HIGH16MEDIUM6

Vulnerabilities

SortPage 1 of 2

CVE-2022-28082P2CRITICALCVSS 9.8v22.03.01.21_cn2022-05-04

CVE-2022-28082 [CRITICAL] CWE-787 CVE-2022-28082: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /gof Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList.

nvd

CVE-2022-28561P2CRITICALCVSS 9.8v22.03.01.21_cn2022-05-03

CVE-2022-28561 [CRITICAL] CWE-787 CVE-2022-28561: There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router. An attacker can obtain a stable shell through a carefully constructed payload

nvd

CVE-2023-49428P2CRITICALCVSS 9.8v22.03.01.462023-12-07

CVE-2023-49428 [CRITICAL] CWE-77 CVE-2023-49428: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.

nvd

CVE-2023-49437P2CRITICALCVSS 9.8v22.03.01.462023-12-07

CVE-2023-49437 [CRITICAL] CWE-77 CVE-2023-49437: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'lis Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.

nvd

CVE-2024-28383P2CRITICALCVSS 9.8v22.03.01.16_cn2024-03-14

CVE-2024-28383 [CRITICAL] CWE-121 CVE-2024-28383: Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in th Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.

nvd

CVE-2023-49426P2CRITICALCVSS 9.8v22.03.01.462023-12-07

CVE-2023-49426 [CRITICAL] CWE-787 CVE-2023-49426: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.

nvd

CVE-2023-49425P2CRITICALCVSS 9.8v22.03.01.462023-12-07

CVE-2023-49425 [CRITICAL] CWE-787 CVE-2023-49425: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at / Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .

nvd

CVE-2023-49424P2CRITICALCVSS 9.8v22.03.01.462023-12-07

CVE-2023-49424 [CRITICAL] CWE-787 CVE-2023-49424: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.

nvd

CVE-2022-45977P2HIGHCVSS 8.8v22.03.01.21_cn2022-12-12

CVE-2022-45977 [HIGH] CWE-78 CVE-2022-45977: Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFil Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.

nvd

CVE-2022-45043P3HIGHCVSS 8.8v22.03.01.16_cn2022-12-12

CVE-2022-45043 [HIGH] CWE-78 CVE-2022-45043: Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set. Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.

nvd

CVE-2022-28917P3HIGHCVSS 7.5v22.03.01.21_cn2022-05-18

CVE-2022-28917 [HIGH] CWE-787 CVE-2022-28917: Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /go Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.

nvd

CVE-2022-45995P3CRITICALCVSS 9.8v22.03.01.21_cn2023-01-05

CVE-2022-45995 [CRITICAL] CVE-2022-45995: There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnera There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnerability can cause the web service not to restart or even execute arbitrary code. It is a different vulnerability from CVE-2022-2414.

nvd

CVE-2023-47422P3HIGHCVSS 8.8v22.03.01.462024-02-20

CVE-2023-47422 [HIGH] CWE-284 CVE-2023-47422: An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL.

nvd

CVE-2021-45392P3HIGHCVSS 7.5v22.03.01.21_cn2022-02-14

CVE-2021-45392 [HIGH] CWE-787 CVE-2021-45392: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 functi A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service.

nvd

CVE-2022-45980P3HIGHCVSS 8.8v22.03.01.21_cn2022-12-12

CVE-2022-45980 [HIGH] CWE-352 CVE-2022-45980: Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .

nvd

CVE-2024-39963P3HIGHCVSS 8.0v22.03.01.462024-07-19

CVE-2024-39963 [HIGH] CWE-77 CVE-2024-39963: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg.

nvd

CVE-2025-29214P3HIGHCVSS 7.5v22.03.01.46_cn2025-03-20

CVE-2025-29214 [HIGH] CWE-121 CVE-2025-29214: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.

nvd

CVE-2022-45979P3HIGHCVSS 7.5v22.03.01.21_cn2022-12-12

CVE-2022-45979 [HIGH] CWE-787 CVE-2022-45979: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /gof Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set .

nvd

CVE-2021-45391P3HIGHCVSS 7.5v22.03.01.21_cn2022-02-16

CVE-2021-45391 [HIGH] CWE-787 CVE-2021-45391: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 functi A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes a Denial of Service.

nvd

CVE-2021-46408P3HIGHCVSS 7.5v22.03.01.212022-03-10

CVE-2021-46408 [HIGH] CWE-787 CVE-2021-46408: Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4 Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4. This vulnerability allows attackers to cause a Denial of Service (DoS) via the strcpy parameter.

nvd

1 / 2Next →