{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Tenda vulnerabilities","home_page_url":"https://patchfirst.co/vendor/tenda/","feed_url":"https://patchfirst.co/feed/vendor/tenda.json","description":"New and newly exploited Tenda CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-113744","url":"https://patchfirst.co/cve/CVE-2026-113744/","title":"CVE-2026-113744: A security vulnerability has been detected in Tenda AC19 16.03.10.07","content_text":"Tenda · AC19. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 10.0 CRITICAL. Priority 18.9 of 100.","summary":"A security vulnerability has been detected in Tenda AC19 16.03.10.07","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-28T17:17:43.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.00622,"percentile":0.49763},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC19","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-114268","url":"https://patchfirst.co/cve/CVE-2026-114268/","title":"CVE-2026-114268: A flaw has been found in Tenda BE3L Pro 16.03.60.62","content_text":"Tenda · BE3L Pro. Not in CISA KEV. EPSS 0.5% (higher than 43.6% of CVEs). CVSS 9.9 CRITICAL. Priority 17.6 of 100.","summary":"A flaw has been found in Tenda BE3L Pro 16.03.60.62","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-28T19:17:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.6,"kev":null,"epss":{"score":0.00511,"percentile":0.43577},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"BE3L Pro","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105778","url":"https://patchfirst.co/cve/CVE-2026-105778/","title":"CVE-2026-105778: A vulnerability has been found in Tenda AC5 02.03.01.111_multi","content_text":"Tenda · AC5. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.9 CRITICAL. Priority 17.4 of 100.","summary":"A vulnerability has been found in Tenda AC5 02.03.01.111_multi","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-06T18:16:46.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.4,"kev":null,"epss":{"score":0.00476,"percentile":0.41134},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC5","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104610","url":"https://patchfirst.co/cve/CVE-2026-104610/","title":"CVE-2026-104610: A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon","content_text":"Tenda · HG7. Not in CISA KEV. EPSS 0.6% (higher than 50.8% of CVEs). CVSS 10.0 CRITICAL. Priority 18.9 of 100.","summary":"A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T14:17:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.00644,"percentile":0.50831},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"HG7","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104611","url":"https://patchfirst.co/cve/CVE-2026-104611/","title":"CVE-2026-104611: A vulnerability was detected in Tenda AC9 15.03.02.13","content_text":"Tenda · AC9. Not in CISA KEV. EPSS 0.5% (higher than 42.3% of CVEs). CVSS 9.1 CRITICAL. Priority 16.6 of 100.","summary":"A vulnerability was detected in Tenda AC9 15.03.02.13","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T14:17:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.6,"kev":null,"epss":{"score":0.00493,"percentile":0.42327},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC9","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78141","url":"https://patchfirst.co/cve/CVE-2026-78141/","title":"CVE-2026-78141: Tenda CH22 exeCommand formexeCommand command injection","content_text":"Tenda · CH22. Not in CISA KEV. EPSS 2.7% (higher than 86.2% of CVEs). CVSS 7.4 HIGH. Public exploit code exists. Priority 72.4 of 100.","summary":"Tenda CH22 exeCommand formexeCommand command injection","date_published":"2026-08-23T00:00:00.000Z","date_modified":"2026-08-27T14:38:00.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":72.4,"kev":null,"epss":{"score":0.02747,"percentile":0.86182},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1"},"vendor":"Tenda","product":"CH22","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-5153","url":"https://patchfirst.co/cve/CVE-2026-5153/","title":"CVE-2026-5153: Tenda CH22 WriteFacMac FormWriteFacMac command injection","content_text":"Tenda · CH22. Not in CISA KEV. EPSS 3.4% (higher than 88.7% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 74.3 of 100.","summary":"Tenda CH22 WriteFacMac FormWriteFacMac command injection","date_published":"2026-03-30T00:00:00.000Z","date_modified":"2026-03-31T15:29:21.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":74.3,"kev":null,"epss":{"score":0.03356,"percentile":0.88692},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Tenda","product":"CH22","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-9090","url":"https://patchfirst.co/cve/CVE-2025-9090/","title":"CVE-2025-9090: Tenda AC20 Telnet Service telnet websFormDefine command injection","content_text":"Tenda · AC20. Not in CISA KEV. EPSS 16.7% (higher than 97% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 73.8 of 100.","summary":"Tenda AC20 Telnet Service telnet websFormDefine command injection","date_published":"2025-08-17T00:00:00.000Z","date_modified":"2025-08-18T17:46:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73.8,"kev":null,"epss":{"score":0.16651,"percentile":0.97019},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Tenda","product":"AC20","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-7544","url":"https://patchfirst.co/cve/CVE-2025-7544/","title":"CVE-2025-7544: Tenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflow","content_text":"Tenda · AC1206. Not in CISA KEV. EPSS 1.8% (higher than 77.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 66.7 of 100.","summary":"Tenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflow","date_published":"2025-07-13T00:00:00.000Z","date_modified":"2025-07-15T19:53:10.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.7,"kev":null,"epss":{"score":0.01751,"percentile":0.77856},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Tenda","product":"AC1206","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-7414","url":"https://patchfirst.co/cve/CVE-2025-7414/","title":"CVE-2025-7414: Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection","content_text":"Tenda · O3V2. Not in CISA KEV. EPSS 12.6% (higher than 96.2% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 66.2 of 100.","summary":"Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection","date_published":"2025-07-10T00:00:00.000Z","date_modified":"2025-07-10T20:47:41.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.2,"kev":null,"epss":{"score":0.1262,"percentile":0.96239},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Tenda","product":"O3V2","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-7417","url":"https://patchfirst.co/cve/CVE-2025-7417/","title":"CVE-2025-7417: Tenda O3V2 httpd setPingInfo fromNetToolGet stack-based overflow","content_text":"Tenda · O3V2. Not in CISA KEV. EPSS 1.0% (higher than 61.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 63.5 of 100.","summary":"Tenda O3V2 httpd setPingInfo fromNetToolGet stack-based overflow","date_published":"2025-07-10T00:00:00.000Z","date_modified":"2025-07-11T16:41:42.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.5,"kev":null,"epss":{"score":0.0096,"percentile":0.61506},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Tenda","product":"O3V2","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-2851","url":"https://patchfirst.co/cve/CVE-2024-2851/","title":"CVE-2024-2851: Tenda AC15 setsambacfg formSetSambaConf os command injection","content_text":"Tenda · AC15. Not in CISA KEV. EPSS 4.0% (higher than 90.5% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 72.5 of 100.","summary":"Tenda AC15 setsambacfg formSetSambaConf os command injection","date_published":"2024-03-24T00:00:00.000Z","date_modified":"2024-08-22T19:16:03.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":72.5,"kev":null,"epss":{"score":0.04009,"percentile":0.90538},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Tenda","product":"AC15","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-10987#kev","url":"https://patchfirst.co/cve/CVE-2020-10987/","title":"[KEV] CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability","content_text":"Tenda · AC1900 Router AC15 Model. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 79.8% (higher than 99.61% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.","summary":"Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:48:48.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.7981,"percentile":0.99608},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC1900 Router AC15 Model","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-31755#kev","url":"https://patchfirst.co/cve/CVE-2021-31755/","title":"[KEV] CVE-2021-31755: Tenda AC11 Router Stack Buffer Overflow Vulnerability","content_text":"Tenda · AC11 Router. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 86.5% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Tenda AC11 Router Stack Buffer Overflow Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:52:12.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.86511,"percentile":0.99737},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC11 Router","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-14558#kev","url":"https://patchfirst.co/cve/CVE-2018-14558/","title":"[KEV] CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability","content_text":"Tenda · AC7, AC9, and AC10 Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 8.5% (higher than 95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.9 of 100.","summary":"Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:41:11.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.0851,"percentile":0.95034},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Tenda","product":"AC7, AC9, and AC10 Routers","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}