The web management server (httpd) of the Tenda W18E router does not properly validate JSON fields of the "diagnose" packet-capture feature. Values in the protocol or targetDevice fields are concatenated into a tcpdump command and run with root privileges. According to the description, an authenticated user can exploit this, and the device can also be exploited without authentication in its factory-reset state. A public proof-of-concept exists, and no vendor fix has been found.
Tenda · W18E
A buffer overflow in the web management function formWifiBasicSet (/goform/WifiBasicSet) of the Tenda BE3L Pro router, firmware 16.03.60.62, is caused by an unchecked strcpy call on the security_5g parameter. An attacker who can reach the web interface can send an oversized value to crash the web server, and possibly execute code on the device. The supplied CVSS 4.0 vector requires low privileges (PR:L), while the VulDB description suggests no authentication is needed; this conflict is unresolved. A public proof of concept exists.
Tenda · BE3L Pro
A stack-based buffer overflow in the httpd web management service of the Tenda AC19 router (firmware 16.03.10.07) can be triggered remotely via the firewallEn argument of the formSetFirewallCfg function at /goform/SetFirewallCfg. An unauthenticated attacker who can reach the admin interface may be able to execute code or take over the device. Public proof-of-concept exploit code is referenced, and VulDB rates exploit maturity as Proof-of-Concept.
Tenda · AC19
The Wi-Fi handler of the web management interface on Tenda AC5 routers does not check the length of the wifiPwd parameter in /goform/setWifi before copying it into a fixed-size stack buffer. An attacker with a valid administrator session can send an oversized value to corrupt memory. A public proof of concept shows control of the instruction pointer and corruption of stored Wi-Fi settings that can survive reboots, so remote code execution is considered likely but is not confirmed.
Tenda · AC5
A stack-based buffer overflow in the web POST request handler of Tenda AC9 router firmware 15.03.02.13 allows an attacker to affect the device via the netWanType argument of /goform/fast_setting_internet_set. According to the CVE description, an exploit is public, but a public proof-of-concept status is conflicting among sources. Exploitation requires high privileges on the router's web management interface (PR:H), so the risk depends mainly on whether that interface is reachable from untrusted networks and how strong the admin credentials are.
Tenda · AC9
Tenda HG7, HG9 and HG10 fibre (xPON) terminals running firmware 300001138_en_xpon contain a stack-based buffer overflow in the Boa web server. The overflow is triggered by an overlong Ethtype parameter sent to /boaform/formLoopBack. A remote attacker may be able to crash the management service or execute code on the device, and a public exploit has been disclosed. The CVSS 4.0 score is 9.3, while the NVD entry is deferred and the conflicting sources disagree on the privileges required.
Tenda · HG7, HG9, HG10 (300001138_en_xpon)
