Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2290 vulnerabilities by tenda
CVE-2026-19822 (GCVE-0-2026-19822)
Vulnerability from cvelistv5 – Published: 2026-08-14 11:30 – Updated: 2026-08-14 11:30
VLAI
EPSS
VEX
Title
Tenda W20E QoS Edit editQos lstAdd stack-based overflow
Summary
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389955 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389955/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19822 | third-party-advisory |
| https://vuldb.com/submit/869006 | third-party-advisory |
| https://github.com/paueger/mycve/blob/main/Tenda_… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:w20e_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"QoS Edit"
],
"product": "W20E",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.11.0.6(1068_1546_841)_CN_TDC"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "paxiot (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T11:30:11.772Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389955 | Tenda W20E QoS Edit editQos lstAdd stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389955"
},
{
"name": "VDB-389955 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389955/cti"
},
{
"name": "CVE-2026-19822 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19822"
},
{
"name": "Submit #869006 | Tenda W20E US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869006"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/paueger/mycve/blob/main/Tenda_W20E/3.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T07:35:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda W20E QoS Edit editQos lstAdd stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19822",
"datePublished": "2026-08-14T11:30:11.772Z",
"dateReserved": "2026-08-14T05:30:15.673Z",
"dateUpdated": "2026-08-14T11:30:11.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19821 (GCVE-0-2026-19821)
Vulnerability from cvelistv5 – Published: 2026-08-14 11:00 – Updated: 2026-08-14 11:00
VLAI
EPSS
VEX
Title
Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow
Summary
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389954 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389954/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19821 | third-party-advisory |
| https://vuldb.com/submit/868922 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ac12:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC12",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T11:00:10.537Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389954 | Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389954"
},
{
"name": "VDB-389954 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389954/cti"
},
{
"name": "CVE-2026-19821 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19821"
},
{
"name": "Submit #868922 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868922"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T07:34:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19821",
"datePublished": "2026-08-14T11:00:10.537Z",
"dateReserved": "2026-08-14T05:29:33.667Z",
"dateUpdated": "2026-08-14T11:00:10.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19792 (GCVE-0-2026-19792)
Vulnerability from cvelistv5 – Published: 2026-08-14 04:00 – Updated: 2026-08-14 10:29
VLAI
EPSS
VEX
Title
Tenda G0 httpd web management interface module setPortMapping buffer overflow
Summary
A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 10:28 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389758 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389758/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19792 | third-party-advisory |
| https://vuldb.com/submit/868929 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19792",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T10:28:44.132624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T10:29:42.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T04:00:09.814Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389758 | Tenda G0 httpd web management interface module setPortMapping buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389758"
},
{
"name": "VDB-389758 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389758/cti"
},
{
"name": "CVE-2026-19792 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19792"
},
{
"name": "Submit #868929 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868929"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd web management interface module setPortMapping buffer overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19792",
"datePublished": "2026-08-14T04:00:09.814Z",
"dateReserved": "2026-08-13T18:55:28.591Z",
"dateUpdated": "2026-08-14T10:29:42.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19791 (GCVE-0-2026-19791)
Vulnerability from cvelistv5 – Published: 2026-08-14 03:45 – Updated: 2026-08-14 03:45
VLAI
EPSS
VEX
Title
Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
Summary
A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389759 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389759/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19791 | third-party-advisory |
| https://vuldb.com/submit/868927 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:45:08.358Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389759 | Tenda G0 httpd web management interface module addStaticRoute stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389759"
},
{
"name": "VDB-389759 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389759/cti"
},
{
"name": "CVE-2026-19791 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19791"
},
{
"name": "Submit #868927 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868927"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/2.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd web management interface module addStaticRoute stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19791",
"datePublished": "2026-08-14T03:45:08.358Z",
"dateReserved": "2026-08-13T18:55:24.764Z",
"dateUpdated": "2026-08-14T03:45:08.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19790 (GCVE-0-2026-19790)
Vulnerability from cvelistv5 – Published: 2026-08-14 03:30 – Updated: 2026-08-14 03:30
VLAI
EPSS
VEX
Title
Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
Summary
A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389757 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389757/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19790 | third-party-advisory |
| https://vuldb.com/submit/868924 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd Web Management Interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:30:10.585Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389757 | Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389757"
},
{
"name": "VDB-389757 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389757/cti"
},
{
"name": "CVE-2026-19790 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19790"
},
{
"name": "Submit #868924 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868924"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/1.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19790",
"datePublished": "2026-08-14T03:30:10.585Z",
"dateReserved": "2026-08-13T18:55:20.872Z",
"dateUpdated": "2026-08-14T03:30:10.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19789 (GCVE-0-2026-19789)
Vulnerability from cvelistv5 – Published: 2026-08-14 03:15 – Updated: 2026-08-14 03:15
VLAI
EPSS
VEX
Title
Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow
Summary
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389756 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389756/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19789 | third-party-advisory |
| https://vuldb.com/submit/868921 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC1206",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:15:10.028Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389756 | Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389756"
},
{
"name": "VDB-389756 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389756/cti"
},
{
"name": "CVE-2026-19789 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19789"
},
{
"name": "Submit #868921 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868921"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/2.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:54:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19789",
"datePublished": "2026-08-14T03:15:10.028Z",
"dateReserved": "2026-08-13T18:47:57.235Z",
"dateUpdated": "2026-08-14T03:15:10.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19788 (GCVE-0-2026-19788)
Vulnerability from cvelistv5 – Published: 2026-08-14 03:00 – Updated: 2026-08-14 03:00
VLAI
EPSS
VEX
Title
Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow
Summary
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389755 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389755/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19788 | third-party-advisory |
| https://vuldb.com/submit/868913 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC1206",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:00:10.875Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389755 | Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389755"
},
{
"name": "VDB-389755 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389755/cti"
},
{
"name": "CVE-2026-19788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19788"
},
{
"name": "Submit #868913 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868913"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:53:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19788",
"datePublished": "2026-08-14T03:00:10.875Z",
"dateReserved": "2026-08-13T18:47:53.219Z",
"dateUpdated": "2026-08-14T03:00:10.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19750 (GCVE-0-2026-19750)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:30 – Updated: 2026-08-13 21:30
VLAI
EPSS
VEX
Title
Tenda CH/CP/TX3 SSH hard-coded password
Summary
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389501 | vdb-entry |
| https://vuldb.com/vuln/389501/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19750 | third-party-advisory |
| https://vuldb.com/submit/868524 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:ch:*:*:*:*:*:*:*:* |
|
| Tenda | CP |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:cp:*:*:*:*:*:*:*:* |
|
| Tenda | TX3 |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:tx3:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "CH",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "CP",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tx3:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "TX3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:30:09.762Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389501 | Tenda CH/CP/TX3 SSH hard-coded password",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389501"
},
{
"name": "VDB-389501 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389501/cti"
},
{
"name": "CVE-2026-19750 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19750"
},
{
"name": "Submit #868524 | Tenda Tenda Multiple IP Cameras Multiple Versions Hard-coded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868524"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Camera%20SSH%20Hard-coded%20Password/Tenda%20Camera%20SSH%20Hard-coded%20Password.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH/CP/TX3 SSH hard-coded password",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19750",
"datePublished": "2026-08-13T21:30:09.762Z",
"dateReserved": "2026-08-13T14:39:41.129Z",
"dateUpdated": "2026-08-13T21:30:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19749 (GCVE-0-2026-19749)
Vulnerability from cvelistv5 – Published: 2026-08-13 20:45 – Updated: 2026-08-13 20:45
VLAI
EPSS
VEX
Title
Tenda CH7 RTSP/ONVIF missing authentication
Summary
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389500 | vdb-entry |
| https://vuldb.com/vuln/389500/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19749 | third-party-advisory |
| https://vuldb.com/submit/868503 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T20:45:09.628Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389500 | Tenda CH7 RTSP/ONVIF missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389500"
},
{
"name": "VDB-389500 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389500/cti"
},
{
"name": "CVE-2026-19749 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19749"
},
{
"name": "Submit #868503 | Tenda Tenda Multiple IP Cameras Multiple Versions Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868503"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 RTSP/ONVIF missing authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19749",
"datePublished": "2026-08-13T20:45:09.628Z",
"dateReserved": "2026-08-13T14:39:36.955Z",
"dateUpdated": "2026-08-13T20:45:09.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19748 (GCVE-0-2026-19748)
Vulnerability from cvelistv5 – Published: 2026-08-13 20:15 – Updated: 2026-08-13 20:15
VLAI
EPSS
VEX
Title
Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy
Summary
A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389499 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389499/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19748 | third-party-advisory |
| https://vuldb.com/submit/868490 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T20:15:10.451Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389499 | Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389499"
},
{
"name": "VDB-389499 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389499/cti"
},
{
"name": "CVE-2026-19748 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19748"
},
{
"name": "Submit #868490 | Tenda Tenda Multiple IP Cameras Multiple Versions Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868490"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19748",
"datePublished": "2026-08-13T20:15:10.451Z",
"dateReserved": "2026-08-13T14:39:32.611Z",
"dateUpdated": "2026-08-13T20:15:10.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19747 (GCVE-0-2026-19747)
Vulnerability from cvelistv5 – Published: 2026-08-13 19:45 – Updated: 2026-08-13 19:45
VLAI
EPSS
VEX
Title
Tenda CH7 ATE Module Kylin HandleCmd command injection
Summary
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.
Severity
9.8 (Critical)
9.8 (Critical)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389498 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389498/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19747 | third-party-advisory |
| https://vuldb.com/submit/868463 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:45:09.236Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389498 | Tenda CH7 ATE Module Kylin HandleCmd command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389498"
},
{
"name": "VDB-389498 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389498/cti"
},
{
"name": "CVE-2026-19747 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19747"
},
{
"name": "Submit #868463 | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868463"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 ATE Module Kylin HandleCmd command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19747",
"datePublished": "2026-08-13T19:45:09.236Z",
"dateReserved": "2026-08-13T14:39:28.581Z",
"dateUpdated": "2026-08-13T19:45:09.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19346 (GCVE-0-2026-19346)
Vulnerability from cvelistv5 – Published: 2026-08-09 10:00 – Updated: 2026-08-10 15:24
VLAI
EPSS
VEX
Title
Tenda CH22 CertListInfo formCertListInfo command injection
Summary
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 15:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387182 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387182/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19346 | third-party-advisory |
| https://vuldb.com/submit/865530 | third-party-advisory |
| https://candle-throne-f75.notion.site/Tenda-CH22-… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T15:23:55.484044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:24:27.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ch22_firmware:*:*:*:*:*:*:*:*"
],
"product": "CH22",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "1.0.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ysnysn0121 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T10:00:10.878Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387182 | Tenda CH22 CertListInfo formCertListInfo command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387182"
},
{
"name": "VDB-387182 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387182/cti"
},
{
"name": "CVE-2026-19346 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19346"
},
{
"name": "Submit #865530 | Tenda CH22 V1.0.0.1 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865530"
},
{
"tags": [
"exploit"
],
"url": "https://candle-throne-f75.notion.site/Tenda-CH22-formCertListInfo-387df0aa118580b4abfcffaf2fceb9ff"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T15:39:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH22 CertListInfo formCertListInfo command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19346",
"datePublished": "2026-08-09T10:00:10.878Z",
"dateReserved": "2026-08-08T13:34:05.069Z",
"dateUpdated": "2026-08-10T15:24:27.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16248 (GCVE-0-2026-16248)
Vulnerability from cvelistv5 – Published: 2026-07-20 12:45 – Updated: 2026-07-20 13:50
VLAI
EPSS
VEX
Title
Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow
Summary
A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 13:50 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380539 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380539/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16248 | third-party-advisory |
| https://vuldb.com/submit/858411 | third-party-advisory |
| https://github.com/teiwiet/tenda-ac10-vulnerabili… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16248",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:50:22.461335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:50:32.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd/netctrl"
],
"product": "AC10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.09_multi_TDE01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "teiwiet (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:45:10.966Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380539 | Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380539"
},
{
"name": "VDB-380539 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380539/cti"
},
{
"name": "CVE-2026-16248 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16248"
},
{
"name": "Submit #858411 | Tenda AC10 V4.0 V16.03.10.09_multi_TDE01 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/858411"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/advisory-fromAdvSetLanip.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-20T09:19:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16248",
"datePublished": "2026-07-20T12:45:10.966Z",
"dateReserved": "2026-07-20T07:14:01.898Z",
"dateUpdated": "2026-07-20T13:50:32.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15696 (GCVE-0-2026-15696)
Vulnerability from cvelistv5 – Published: 2026-07-14 14:45 – Updated: 2026-07-14 15:15
VLAI
EPSS
VEX
Title
Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow
Summary
A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 15:13 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/378243 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/378243/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15696 | third-party-advisory |
| https://vuldb.com/submit/856019 | third-party-advisory |
| https://github.com/cve-a/dexingzhiqing/issues/6 | exploitissue-tracking |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15696",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T15:13:05.975572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:15:11.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*"
],
"product": "BE12 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.66.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dexingzhiqing (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:45:11.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-378243 | Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/378243"
},
{
"name": "VDB-378243 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/378243/cti"
},
{
"name": "CVE-2026-15696 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15696"
},
{
"name": "Submit #856019 | Tenda BE12 Pro V16.03.66.23 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856019"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cve-a/dexingzhiqing/issues/6"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-14T07:03:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15696",
"datePublished": "2026-07-14T14:45:11.818Z",
"dateReserved": "2026-07-14T04:58:22.099Z",
"dateUpdated": "2026-07-14T15:15:11.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15695 (GCVE-0-2026-15695)
Vulnerability from cvelistv5 – Published: 2026-07-14 14:30 – Updated: 2026-07-15 16:11
VLAI
EPSS
VEX
Title
Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow
Summary
A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 16:11 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/378242 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/378242/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15695 | third-party-advisory |
| https://vuldb.com/submit/856017 | third-party-advisory |
| https://github.com/cve-a/dexingzhiqing/issues/5 | exploitissue-tracking |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15695",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T16:11:15.500883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:11:22.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*"
],
"product": "BE12 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.66.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dexingzhiqing (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:30:09.879Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-378242 | Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/378242"
},
{
"name": "VDB-378242 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/378242/cti"
},
{
"name": "CVE-2026-15695 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15695"
},
{
"name": "Submit #856017 | Tenda BE12 Pro V16.03.66.23 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856017"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cve-a/dexingzhiqing/issues/5"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-14T07:03:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15695",
"datePublished": "2026-07-14T14:30:09.879Z",
"dateReserved": "2026-07-14T04:58:19.512Z",
"dateUpdated": "2026-07-15T16:11:22.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19821 (GCVE-0-2026-19821)
Vulnerability from nvd – Published: 2026-08-14 11:00 – Updated: 2026-08-14 11:00
VLAI
EPSS
VEX
Title
Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow
Summary
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389954 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389954/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19821 | third-party-advisory |
| https://vuldb.com/submit/868922 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ac12:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC12",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T11:00:10.537Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389954 | Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389954"
},
{
"name": "VDB-389954 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389954/cti"
},
{
"name": "CVE-2026-19821 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19821"
},
{
"name": "Submit #868922 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868922"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T07:34:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19821",
"datePublished": "2026-08-14T11:00:10.537Z",
"dateReserved": "2026-08-14T05:29:33.667Z",
"dateUpdated": "2026-08-14T11:00:10.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19792 (GCVE-0-2026-19792)
Vulnerability from nvd – Published: 2026-08-14 04:00 – Updated: 2026-08-14 10:29
VLAI
EPSS
VEX
Title
Tenda G0 httpd web management interface module setPortMapping buffer overflow
Summary
A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 10:28 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389758 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389758/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19792 | third-party-advisory |
| https://vuldb.com/submit/868929 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19792",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T10:28:44.132624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T10:29:42.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T04:00:09.814Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389758 | Tenda G0 httpd web management interface module setPortMapping buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389758"
},
{
"name": "VDB-389758 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389758/cti"
},
{
"name": "CVE-2026-19792 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19792"
},
{
"name": "Submit #868929 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868929"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd web management interface module setPortMapping buffer overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19792",
"datePublished": "2026-08-14T04:00:09.814Z",
"dateReserved": "2026-08-13T18:55:28.591Z",
"dateUpdated": "2026-08-14T10:29:42.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19791 (GCVE-0-2026-19791)
Vulnerability from nvd – Published: 2026-08-14 03:45 – Updated: 2026-08-14 03:45
VLAI
EPSS
VEX
Title
Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
Summary
A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389759 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389759/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19791 | third-party-advisory |
| https://vuldb.com/submit/868927 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:45:08.358Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389759 | Tenda G0 httpd web management interface module addStaticRoute stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389759"
},
{
"name": "VDB-389759 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389759/cti"
},
{
"name": "CVE-2026-19791 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19791"
},
{
"name": "Submit #868927 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868927"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/2.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd web management interface module addStaticRoute stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19791",
"datePublished": "2026-08-14T03:45:08.358Z",
"dateReserved": "2026-08-13T18:55:24.764Z",
"dateUpdated": "2026-08-14T03:45:08.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19790 (GCVE-0-2026-19790)
Vulnerability from nvd – Published: 2026-08-14 03:30 – Updated: 2026-08-14 03:30
VLAI
EPSS
VEX
Title
Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
Summary
A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389757 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389757/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19790 | third-party-advisory |
| https://vuldb.com/submit/868924 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd Web Management Interface"
],
"product": "G0",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:30:10.585Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389757 | Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389757"
},
{
"name": "VDB-389757 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389757/cti"
},
{
"name": "CVE-2026-19790 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19790"
},
{
"name": "Submit #868924 | Tenda G0 Tenda G0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868924"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/1.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T21:00:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19790",
"datePublished": "2026-08-14T03:30:10.585Z",
"dateReserved": "2026-08-13T18:55:20.872Z",
"dateUpdated": "2026-08-14T03:30:10.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19789 (GCVE-0-2026-19789)
Vulnerability from nvd – Published: 2026-08-14 03:15 – Updated: 2026-08-14 03:15
VLAI
EPSS
VEX
Title
Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow
Summary
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389756 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389756/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19789 | third-party-advisory |
| https://vuldb.com/submit/868921 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC1206",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:15:10.028Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389756 | Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389756"
},
{
"name": "VDB-389756 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389756/cti"
},
{
"name": "CVE-2026-19789 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19789"
},
{
"name": "Submit #868921 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868921"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/2.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:54:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19789",
"datePublished": "2026-08-14T03:15:10.028Z",
"dateReserved": "2026-08-13T18:47:57.235Z",
"dateUpdated": "2026-08-14T03:15:10.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19788 (GCVE-0-2026-19788)
Vulnerability from nvd – Published: 2026-08-14 03:00 – Updated: 2026-08-14 03:00
VLAI
EPSS
VEX
Title
Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow
Summary
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389755 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389755/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19788 | third-party-advisory |
| https://vuldb.com/submit/868913 | third-party-advisory |
| https://github.com/lipenghai/iot_bug/blob/main/Te… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd web management interface"
],
"product": "AC1206",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.23_multi_TD01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "stksgg (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:00:10.875Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389755 | Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389755"
},
{
"name": "VDB-389755 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389755/cti"
},
{
"name": "CVE-2026-19788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19788"
},
{
"name": "Submit #868913 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868913"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:53:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19788",
"datePublished": "2026-08-14T03:00:10.875Z",
"dateReserved": "2026-08-13T18:47:53.219Z",
"dateUpdated": "2026-08-14T03:00:10.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19750 (GCVE-0-2026-19750)
Vulnerability from nvd – Published: 2026-08-13 21:30 – Updated: 2026-08-13 21:30
VLAI
EPSS
VEX
Title
Tenda CH/CP/TX3 SSH hard-coded password
Summary
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389501 | vdb-entry |
| https://vuldb.com/vuln/389501/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19750 | third-party-advisory |
| https://vuldb.com/submit/868524 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:ch:*:*:*:*:*:*:*:* |
|
| Tenda | CP |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:cp:*:*:*:*:*:*:*:* |
|
| Tenda | TX3 |
Affected:
V21.*
Affected: V22.* Affected: V25.* Affected: V26.* Affected: V27.* cpe:2.3:h:tenda:tx3:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "CH",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "CP",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tx3:*:*:*:*:*:*:*:*"
],
"modules": [
"SSH"
],
"product": "TX3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "V21.*"
},
{
"status": "affected",
"version": "V22.*"
},
{
"status": "affected",
"version": "V25.*"
},
{
"status": "affected",
"version": "V26.*"
},
{
"status": "affected",
"version": "V27.*"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:30:09.762Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389501 | Tenda CH/CP/TX3 SSH hard-coded password",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389501"
},
{
"name": "VDB-389501 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389501/cti"
},
{
"name": "CVE-2026-19750 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19750"
},
{
"name": "Submit #868524 | Tenda Tenda Multiple IP Cameras Multiple Versions Hard-coded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868524"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Camera%20SSH%20Hard-coded%20Password/Tenda%20Camera%20SSH%20Hard-coded%20Password.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH/CP/TX3 SSH hard-coded password",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19750",
"datePublished": "2026-08-13T21:30:09.762Z",
"dateReserved": "2026-08-13T14:39:41.129Z",
"dateUpdated": "2026-08-13T21:30:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19749 (GCVE-0-2026-19749)
Vulnerability from nvd – Published: 2026-08-13 20:45 – Updated: 2026-08-13 20:45
VLAI
EPSS
VEX
Title
Tenda CH7 RTSP/ONVIF missing authentication
Summary
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389500 | vdb-entry |
| https://vuldb.com/vuln/389500/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19749 | third-party-advisory |
| https://vuldb.com/submit/868503 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"RTSP/ONVIF"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T20:45:09.628Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389500 | Tenda CH7 RTSP/ONVIF missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389500"
},
{
"name": "VDB-389500 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389500/cti"
},
{
"name": "CVE-2026-19749 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19749"
},
{
"name": "Submit #868503 | Tenda Tenda Multiple IP Cameras Multiple Versions Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868503"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 RTSP/ONVIF missing authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19749",
"datePublished": "2026-08-13T20:45:09.628Z",
"dateReserved": "2026-08-13T14:39:36.955Z",
"dateUpdated": "2026-08-13T20:45:09.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19748 (GCVE-0-2026-19748)
Vulnerability from nvd – Published: 2026-08-13 20:15 – Updated: 2026-08-13 20:15
VLAI
EPSS
VEX
Title
Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy
Summary
A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389499 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389499/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19748 | third-party-advisory |
| https://vuldb.com/submit/868490 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"Kylin Web Service"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T20:15:10.451Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389499 | Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389499"
},
{
"name": "VDB-389499 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389499/cti"
},
{
"name": "CVE-2026-19748 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19748"
},
{
"name": "Submit #868490 | Tenda Tenda Multiple IP Cameras Multiple Versions Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868490"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19748",
"datePublished": "2026-08-13T20:15:10.451Z",
"dateReserved": "2026-08-13T14:39:32.611Z",
"dateUpdated": "2026-08-13T20:15:10.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19747 (GCVE-0-2026-19747)
Vulnerability from nvd – Published: 2026-08-13 19:45 – Updated: 2026-08-13 19:45
VLAI
EPSS
VEX
Title
Tenda CH7 ATE Module Kylin HandleCmd command injection
Summary
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.
Severity
9.8 (Critical)
9.8 (Critical)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389498 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389498/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19747 | third-party-advisory |
| https://vuldb.com/submit/868463 | third-party-advisory |
| https://github.com/howitouchyou/Tenda-Smart-Camer… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | CH7 |
Affected:
20260625
cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:* |
|
| Tenda | CH7G |
Affected:
20260625
cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:* |
|
| Tenda | CH10 |
Affected:
20260625
cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 |
Affected:
20260625
cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:* |
|
| Tenda | CP3 Pro |
Affected:
20260625
cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:* |
|
| Tenda | CP7 |
Affected:
20260625
cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3B15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T14C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:* |
|
| Tenda | TC3T15C |
Affected:
20260625
cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH7G",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CH10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP3",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP3 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "CP7",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3B14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3B15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3T14C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
},
{
"cpes": [
"cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"
],
"modules": [
"ATE Module"
],
"product": "TC3T15C",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "20260625"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Howitouchyou (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:45:09.236Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389498 | Tenda CH7 ATE Module Kylin HandleCmd command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389498"
},
{
"name": "VDB-389498 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389498/cti"
},
{
"name": "CVE-2026-19747 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19747"
},
{
"name": "Submit #868463 | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868463"
},
{
"tags": [
"related"
],
"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T16:44:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH7 ATE Module Kylin HandleCmd command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19747",
"datePublished": "2026-08-13T19:45:09.236Z",
"dateReserved": "2026-08-13T14:39:28.581Z",
"dateUpdated": "2026-08-13T19:45:09.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19346 (GCVE-0-2026-19346)
Vulnerability from nvd – Published: 2026-08-09 10:00 – Updated: 2026-08-10 15:24
VLAI
EPSS
VEX
Title
Tenda CH22 CertListInfo formCertListInfo command injection
Summary
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 15:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387182 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387182/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19346 | third-party-advisory |
| https://vuldb.com/submit/865530 | third-party-advisory |
| https://candle-throne-f75.notion.site/Tenda-CH22-… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T15:23:55.484044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:24:27.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ch22_firmware:*:*:*:*:*:*:*:*"
],
"product": "CH22",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "1.0.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ysnysn0121 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T10:00:10.878Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387182 | Tenda CH22 CertListInfo formCertListInfo command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387182"
},
{
"name": "VDB-387182 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387182/cti"
},
{
"name": "CVE-2026-19346 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19346"
},
{
"name": "Submit #865530 | Tenda CH22 V1.0.0.1 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865530"
},
{
"tags": [
"exploit"
],
"url": "https://candle-throne-f75.notion.site/Tenda-CH22-formCertListInfo-387df0aa118580b4abfcffaf2fceb9ff"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T15:39:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda CH22 CertListInfo formCertListInfo command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19346",
"datePublished": "2026-08-09T10:00:10.878Z",
"dateReserved": "2026-08-08T13:34:05.069Z",
"dateUpdated": "2026-08-10T15:24:27.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16248 (GCVE-0-2026-16248)
Vulnerability from nvd – Published: 2026-07-20 12:45 – Updated: 2026-07-20 13:50
VLAI
EPSS
VEX
Title
Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow
Summary
A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 13:50 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380539 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380539/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16248 | third-party-advisory |
| https://vuldb.com/submit/858411 | third-party-advisory |
| https://github.com/teiwiet/tenda-ac10-vulnerabili… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16248",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:50:22.461335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:50:32.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd/netctrl"
],
"product": "AC10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.09_multi_TDE01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "teiwiet (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:45:10.966Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380539 | Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380539"
},
{
"name": "VDB-380539 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380539/cti"
},
{
"name": "CVE-2026-16248 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16248"
},
{
"name": "Submit #858411 | Tenda AC10 V4.0 V16.03.10.09_multi_TDE01 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/858411"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/advisory-fromAdvSetLanip.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-20T09:19:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16248",
"datePublished": "2026-07-20T12:45:10.966Z",
"dateReserved": "2026-07-20T07:14:01.898Z",
"dateUpdated": "2026-07-20T13:50:32.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15696 (GCVE-0-2026-15696)
Vulnerability from nvd – Published: 2026-07-14 14:45 – Updated: 2026-07-14 15:15
VLAI
EPSS
VEX
Title
Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow
Summary
A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 15:13 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/378243 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/378243/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15696 | third-party-advisory |
| https://vuldb.com/submit/856019 | third-party-advisory |
| https://github.com/cve-a/dexingzhiqing/issues/6 | exploitissue-tracking |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15696",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T15:13:05.975572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:15:11.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*"
],
"product": "BE12 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.66.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dexingzhiqing (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:45:11.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-378243 | Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/378243"
},
{
"name": "VDB-378243 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/378243/cti"
},
{
"name": "CVE-2026-15696 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15696"
},
{
"name": "Submit #856019 | Tenda BE12 Pro V16.03.66.23 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856019"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cve-a/dexingzhiqing/issues/6"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-14T07:03:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15696",
"datePublished": "2026-07-14T14:45:11.818Z",
"dateReserved": "2026-07-14T04:58:22.099Z",
"dateUpdated": "2026-07-14T15:15:11.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15695 (GCVE-0-2026-15695)
Vulnerability from nvd – Published: 2026-07-14 14:30 – Updated: 2026-07-15 16:11
VLAI
EPSS
VEX
Title
Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow
Summary
A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 16:11 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/378242 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/378242/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15695 | third-party-advisory |
| https://vuldb.com/submit/856017 | third-party-advisory |
| https://github.com/cve-a/dexingzhiqing/issues/5 | exploitissue-tracking |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15695",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T16:11:15.500883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:11:22.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*"
],
"product": "BE12 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.66.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dexingzhiqing (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:30:09.879Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-378242 | Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/378242"
},
{
"name": "VDB-378242 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/378242/cti"
},
{
"name": "CVE-2026-15695 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15695"
},
{
"name": "Submit #856017 | Tenda BE12 Pro V16.03.66.23 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856017"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cve-a/dexingzhiqing/issues/5"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-14T07:03:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15695",
"datePublished": "2026-07-14T14:30:09.879Z",
"dateReserved": "2026-07-14T04:58:19.512Z",
"dateUpdated": "2026-07-15T16:11:22.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15694 (GCVE-0-2026-15694)
Vulnerability from nvd – Published: 2026-07-14 14:15 – Updated: 2026-07-14 14:35
VLAI
EPSS
VEX
Title
Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow
Summary
A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 14:35 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/378241 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/378241/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15694 | third-party-advisory |
| https://vuldb.com/submit/856015 | third-party-advisory |
| https://github.com/cve-a/dexingzhiqing/issues/4 | exploitissue-tracking |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15694",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T14:35:08.614268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:35:17.481Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*"
],
"product": "BE12 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.66.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dexingzhiqing (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:15:09.735Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-378241 | Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/378241"
},
{
"name": "VDB-378241 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/378241/cti"
},
{
"name": "CVE-2026-15694 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15694"
},
{
"name": "Submit #856015 | Tenda BE12 Pro V16.03.66.23 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856015"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cve-a/dexingzhiqing/issues/4"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-14T07:03:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15694",
"datePublished": "2026-07-14T14:15:09.735Z",
"dateReserved": "2026-07-14T04:58:16.916Z",
"dateUpdated": "2026-07-14T14:35:17.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}