Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
106 results · page 1 of 3
Jun 8, 2026A weakness has been identified in Tenda AC15 15.03.05.19.CVE-2026-11493 · Network & remote access · Tenda · reported by VulDBLow 1.3
A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026A vulnerability was identified in Tenda AC15 15.03.05.18.CVE-2026-5830 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda AC15 15.03.05.18. This affects the function websGetVar of the file /goform/SysToolChangePwd. Such manipulation of the argument oldPwd/newPwd/cfmPwd leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.catbox.moevuldb.com
Mar 27, 2026A vulnerability has been found in Tenda AC15 15.03.05.19.CVE-2026-4975 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Mar 3, 2026A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.CVE-2026-24103 · Network & remote access · Tenda · reported by MITRECritical 9.8
A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenda.com.cn
Mar 2, 2026An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi.CVE-2026-24105 · Network & remote access · Tenda · reported by MITRECritical 9.8
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenda.com.cn
Mar 2, 2026An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi.CVE-2026-24101 · Network & remote access · Tenda · reported by MITRECritical 9.8
An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenda.com.cn
Mar 1, 2026A security flaw has been discovered in Tenda AC15 up to 15.13.07.13.CVE-2026-3400 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the CVE-2025-63666 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A security flaw has been discovered in Tenda AC15 15.03.05.18.CVE-2025-11389 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of the argument enable results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A vulnerability was identified in Tenda AC15 15.03.05.18.CVE-2025-11388 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A vulnerability was determined in Tenda AC15 15.03.05.18.CVE-2025-11387 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This manipulation of the argument Password causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A vulnerability was found in Tenda AC15 15.03.05.18.CVE-2025-11386 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the component POST Parameter Handler. The manipulation of the argument ddnsEn results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18.CVE-2025-10443 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14.CVE-2025-10442 · Network & remote access · Tenda · reported by VulDBLow 2.1
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.CVE-2025-55564 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was identified in Tenda AC15 15.13.07.13.CVE-2025-8979 · Network & remote access · Tenda · reported by VulDBMedium 6.6
A vulnerability was identified in Tenda AC15 15.13.07.13. Affected by this vulnerability is the function check_fw_type/split_fireware/check_fw of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2025A vulnerability was found in Tenda AC15 15.03.05.19_multi.CVE-2025-5851 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been rated as critical. This issue affects the function fromadvsetlanip of the file /goform/AdvSetLanip of the component HTTP POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 8, 2025A vulnerability was found in Tenda AC15 15.03.05.19_multi.CVE-2025-5850 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the file /goform/SetLEDCf of the component HTTP POST Request Handler. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 8, 2025A vulnerability was found in Tenda AC15 15.03.05.19_multi.CVE-2025-5849 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 8, 2025A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical.CVE-2025-5848 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Apr 18, 2025A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical.CVE-2025-3786 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13.CVE-2025-29462 · Network & remote access · Tenda · reported by MITRECritical 9.8
A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo.CVE-2025-25634 · Network & remote access · Tenda · reported by MITREMedium 6.5
A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src leads to stack-based buffer overflow.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.CVE-2025-25632 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13.CVE-2025-0566 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpan.baidu.comvuldb.com
Nov 1, 2024A vulnerability was found in Tenda AC15 15.03.05.19 and classified as critical.CVE-2024-10662 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was found in Tenda AC15 15.03.05.19 and classified as critical. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical.CVE-2024-10661 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical. This vulnerability affects the function SetDlnaCfg of the file /goform/SetDlnaCfg. The manipulation of the argument scanList leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022.CVE-2024-10280 · Network & remote access · Tenda · reported by VulDBHigh 7.1
A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST reqCVE-2023-36103 · Network & remote access · tenda · reported by MITRECritical 9.8
Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST request.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Tenda AC15 v15.03.20_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle funCVE-2024-32303 · Network & remote access · tenda · reported by MITREHigh 8
Tenda AC15 v15.03.20_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient functCVE-2024-30840 · Network & remote access · tenda · reported by MITREMedium 6.5
A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient function.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.CVE-2024-30645 · Network & remote access · tenda · reported by MITREHigh 8
Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.
- Product
- ac15v1.0_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function.CVE-2024-30613 · Network & remote access · tenda · reported by MITREMedium 4.3
Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2024A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.05.19/15.03.20.CVE-2024-2855 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.05.19/15.03.20. Affected by this vulnerability is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2024A vulnerability was found in Tenda AC15 15.03.20_multi.CVE-2024-2852 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2024A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2851 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2024A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical.CVE-2024-2850 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument urls leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18.CVE-2024-2817 · Network & remote access · Tenda · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as problematic was found in Tenda AC15 15.03.05.18.CVE-2024-2816 · Network & remote access · Tenda · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Tenda AC15 15.03.05.18. Affected by this vulnerability is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi.CVE-2024-2815 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand of the component Cookie Handler. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability was found in Tenda AC15 15.03.20_multi.CVE-2024-2814 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.20_multi. It has been rated as critical. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability was found in Tenda AC15 15.03.20_multi.CVE-2024-2813 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2812 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical.CVE-2024-2811 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical.CVE-2024-2810 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical. Affected by this vulnerability is the function formWifiWpsOOB of the file /goform/WifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257665 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2809 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi. Affected is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2808 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2807 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.20_multi. This vulnerability affects the function formExpandDlnaFile of the file /goform/expandDlnaFile. The manipulation of the argument filePath leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2806 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This affects the function addWifiMacFilter of the file /goform/addWifiMacFilter. The manipulation of the argument deviceId/deviceMac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi.CVE-2024-2805 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been rated as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.