Tenda Vulnerabilities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Type

The moderation team is working with the threat intelligence team to categorize software that is affected by security vulnerabilities. This helps to illustrate the assignment of these categories to determine the most affected software types.

Product

Tenda AC974
Tenda AC1872
Tenda AC672
Tenda AC1571
Tenda AC1062

Grouping vulnerabilities by products helps to get an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.

Remediation

Official Fix6
Temporary Fix0
Workaround3
Unavailable0
Not Defined1088

Vendors and researchers are eager to find countermeasures to mitigate security vulnerabilities. These can be distinguished between multiple forms and levels of remediation which influence risks differently.

Exploitability

High3
Functional1
Proof-of-Concept235
Unproven0
Not Defined858

Researcher and attacker which are looking for security vulnerabilities try to exploit them for academic purposes or personal gain. The level and quality of exploitability can be distinguished to determine simplicity and strength of attacks.

Access Vector

Not Defined0
Physical2
Local19
Adjacent692
Network384

The approach a vulnerability it becomes important to use the expected access vector. This is typically via the network, local, or physically even.

Authentication

Not Defined0
High25
Low993
None79

To exploit a vulnerability a certail level of authentication might be required. Vulnerabilities without such a requirement are much more popular.

User Interaction

Not Defined0
Required22
None1075

Some attack scenarios require some user interaction by a victim. This is typical for phishing, social engineering and cross site scripting attacks.

C3BM Index

Our unique C3BM Index (CVSSv3 Base Meta Index) cumulates the CVSSv3 Meta Base Scores of all entries over time. Comparing this index to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

CVSSv3 Base

≤10
≤20
≤31
≤438
≤519
≤6187
≤7231
≤8355
≤9235
≤1031

The Common Vulnerability Scoring System (CVSS) is an industry standard to define the characteristics and impacts of security vulnerabilities. The base score represents the intrinsic aspects that are constant over time and across user environments. Our unique meta score merges all available scores from different sources to aggregate to the most reliable result.

CVSSv3 Temp

≤10
≤20
≤31
≤439
≤518
≤6197
≤7235
≤8401
≤9199
≤107

The Common Vulnerability Scoring System (CVSS) uses temp scores to reflect the characteristics of a vulnerability that may change over time but not across user environments. This includes reporting confidence, exploitability and remediation levels. We do also provide our unique meta score for temp scores, even though other sources rarely publish them.

VulDB

≤10
≤20
≤32
≤471
≤534
≤6636
≤769
≤842
≤9234
≤109

The moderation team is always defining the base vector and base score for an entry. These and all other available scores are used to generate the meta score.

NVD

≤10
≤20
≤30
≤41
≤53
≤611
≤719
≤8206
≤919
≤10384

The National Vulnerability Database (NVD) is also defining CVSS vectors and scores. These are usually not complete and might differ from VulDB scores.

CNA

≤10
≤20
≤30
≤40
≤514
≤61
≤711
≤813
≤9132
≤101

A CVE Numbering Authority (CNA) is responsible for assigning new CVE entries. They might also include a CVSS score. These are usually not complete and might differ from VulDB scores.

Vendor

≤10
≤20
≤30
≤40
≤50
≤60
≤70
≤80
≤90
≤100

Some vendors are willing to publish their own CVSS vectors and scores for vulnerabilities in their products. The coverage varies from vendor to vendor.

Research

≤10
≤20
≤30
≤40
≤50
≤61
≤70
≤80
≤90
≤101

There are sometimes also security researcher which provide their own CVSS vectors and scores for vulnerabilities they have found and published.

Exploit 0-day

<1k42
<2k590
<5k465
<10k0
<25k0
<50k0
<100k0
≥100k0

The moderation team is working with the threat intelligence team to determine prices for exploits. Our unique algorithm is used to identify the 0-day prices for an exploit, before it got distributed or became public. Calculated prices are aligned to prices disclosed by vulnerability broker and compared to prices we see on exploit markets.

Exploit Today

<1k784
<2k273
<5k40
<10k0
<25k0
<50k0
<100k0
≥100k0

The 0-day prices do not consider time-relevant factors. The today price does reflect price impacts like disclosure of vulnerability details, alternative exploits, availability of countermeasures. These dynamic aspects might decrease the exploit prices over time. Under certain circumstances this happens very fast.

Exploit Market Volume

Our unique calculation of exploit prices makes it possible to forecast the expected exploit market volume. The calculated prices for all possible 0-day expoits are cumulated for this task. Comparing the volume to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

🔴 CTI Activities

Our unique Cyber Threat Intelligence aims to determine the ongoing research of actors to anticipiate their acitivities. Observing exploit markets on the Darknet, discussions of vulnerabilities on mailinglists, and exchanges on social media makes it possible to identify planned attacks. Monitored actors and activities are classified whether they are offensive or defensive. They are also weighted as some actors are well-known for certain products and technologies. And some of their disclosures might contain more or less details about technical aspects and personal context. The world map highlights active actors in real-time.

Affected Products (93): 4G300 (6), 11N (1), A5s (1), A15 (17), A18 (7), A32 (1), A301 (1), AC-10U AC1200 (1), AC5 (27), AC5 AC1200 (1), AC6 (72), AC7 (43), AC8 (22), AC8V4 (4), AC9 (74), AC9 Router AC1200 (2), AC10 (62), AC10 V4 (1), AC10-1200 (3), AC10U (37), AC10V4 (1), AC11 (9), AC15 (71), AC15V1.0 (2), AC18 (72), AC19 (1), AC21 (13), AC23 (21), AC118 (6), AC500 (14), AC1200 (23), AC1206 (31), AC1900 (5), ADSL2-2+ Modem D840R (1), ADSL Modem (1), AX3 (34), AX9 (9), AX12 (24), AX1803 (50), AX1806 (34), CP3 (7), CP7 (1), D152 (1), D820R ADSL2-2+ Modem (1), F1200 (2), F1202 (25), F1203 (33), FH1202 (31), FH1203 (31), FH1205 (26), FH1206 (14), G0 (1), G1 (25), G3 (30), G103 (3), HG6 (1), IT7-LCS (1), IT7-PCS (1), IT7-PRS (1), M3 (35), N300 F3 (2), N300 Wireless N VDSL2 Modem Router (1), N301 (2), N301 Wireless Router (2), O3V2 (1), ONT GPON AC1200 (1), PA6 (1), PA6 Wi-Fi Powerline Extender (3), PA202 (2), PW201A (2), RX9 Pro (2), RX9_Pro (3), TX3 (7), TX9 (6), TX9 Pro (4), Tenda A15 (1), Tenda AX12 (1), Tenda W30E (2), Tenda i22 (1), W6 (8), W6-S (6), W9 (18), W15E (15), W15EV1 (5), W18E (2), W20E (10), W30E (44), WH450 (1), i6 (6), i9 (9), i21 (19), i22 (10), i29 (10)

PublishedBaseTempVulnerabilityProdExpRemEPSSCTICVE
05/24/20245.55.5Tenda FH1206 formexeCommand command injectionUnknownNot DefinedNot Defined0.000000.03CVE-2024-35340
05/24/20245.55.5Tenda FH1206 WriteFacMac command injectionUnknownNot DefinedNot Defined0.000000.07CVE-2024-35339
05/20/20248.88.8Tenda AX1806 formSetIptv stack-based overflowUnknownNot DefinedNot Defined0.000000.07CVE-2024-35571
05/20/20248.88.8Tenda AX1806 formSetIptv stack-based overflowUnknownNot DefinedNot Defined0.000000.05CVE-2024-35580
05/20/20248.88.8Tenda AX1806 formSetIptv stack-based overflowUnknownNot DefinedNot Defined0.000000.03CVE-2024-35579
05/20/20248.88.8Tenda AX1806 formSetIptv stack-based overflowUnknownNot DefinedNot Defined0.000000.03CVE-2024-35578
05/20/20248.88.8Tenda AX1806 formSetIptv stack-based overflowUnknownNot DefinedNot Defined0.000000.04CVE-2024-35576
05/10/20248.88.8Tenda FH1206 DhcpListClient stack-based overflowUnknownNot DefinedNot Defined0.000000.06CVE-2024-34946
05/10/20248.88.8Tenda FH1206 WizardHandle stack-based overflowUnknownNot DefinedNot Defined0.000000.03CVE-2024-34945
05/10/20248.88.8Tenda FH1206 DhcpListClient stack-based overflowUnknownNot DefinedNot Defined0.000000.03CVE-2024-34944
05/10/20248.88.8Tenda FH1206 NatStaticSetting stack-based overflowUnknownNot DefinedNot Defined0.000000.06CVE-2024-34943
05/10/20248.88.8Tenda FH1206 exeCommand stack-based overflowUnknownNot DefinedNot Defined0.000000.04CVE-2024-34942
05/10/20248.88.5Tenda AC18 formSetPPTPServer buffer overflowUnknownNot DefinedNot Defined0.000000.00CVE-2024-34974
05/09/20246.36.3Tenda O3V2 getTraceroute command injectionUnknownNot DefinedNot Defined0.000000.04CVE-2024-34338
05/04/20248.88.0Tenda i21 formexeCommand stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.10CVE-2024-4497
05/04/20248.88.0Tenda i21 formWifiMacFilterSet stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.10CVE-2024-4496
05/04/20248.88.0Tenda i21 formWifiMacFilterGet stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.11CVE-2024-4495
05/04/20248.88.0Tenda i21 setUplinkInfo formSetUplinkInfo stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.17CVE-2024-4494
05/04/20248.88.0Tenda i21 formSetAutoPing stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.14CVE-2024-4493
05/04/20248.88.0Tenda i21 setStaOffline formOfflineSet stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.10CVE-2024-4492
05/04/20248.88.0Tenda i21 formGetDiagnoseInfo stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.13CVE-2024-4491
05/01/20248.88.3Tenda AC18 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflowUnknownProof-of-ConceptNot Defined0.000430.03CVE-2024-33835
04/27/20248.88.4Tenda A301 setBlackRule formAddMacfilterRule stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.25CVE-2024-4291
04/26/20243.73.7Tenda N300 F3 Security Policy weak passwordUnknownNot DefinedNot Defined0.000430.04CVE-2024-25343
04/26/20248.88.5Tenda i22 formSetUrlFilterRule stack-based overflowUnknownNot DefinedNot Defined0.000451.40CVE-2024-4252
04/26/20248.88.4Tenda i21 DhcpSetSe fromDhcpSetSer stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.84CVE-2024-4251
04/26/20248.88.4Tenda i21 wifiSSIDset formwrlSSIDset stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.22CVE-2024-4250
04/26/20248.88.4Tenda i21 wifiSSIDget formwrlSSIDget stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.97CVE-2024-4249
04/26/20248.88.6Tenda i21 formQosManage_user stack-based overflowUnknownNot DefinedNot Defined0.000450.84CVE-2024-4248
04/26/20248.88.6Tenda i21 formQosManage_auto stack-based overflowUnknownNot DefinedNot Defined0.000451.02CVE-2024-4247
04/26/20248.88.6Tenda i21 formQosManageDouble_auto stack-based overflowUnknownNot DefinedNot Defined0.000451.09CVE-2024-4246
04/26/20248.88.6Tenda i21 formQosManageDouble_user stack-based overflowUnknownNot DefinedNot Defined0.000451.00CVE-2024-4245
04/26/20248.88.4Tenda W9 DhcpSetSer fromDhcpSetSer stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.18CVE-2024-4244
04/26/20248.88.4Tenda W9 wifiSSIDset formwrlSSIDset stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.15CVE-2024-4243
04/26/20248.88.4Tenda W9 wifiSSIDget formwrlSSIDget stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.11CVE-2024-4242
04/26/20248.88.6Tenda W9 formQosManageDouble_auto stack-based overflowUnknownNot DefinedNot Defined0.000451.15CVE-2024-4241
04/26/20248.88.6Tenda W9 formQosManageDouble_user stack-based overflowUnknownNot DefinedNot Defined0.000451.11CVE-2024-4240
04/26/20248.88.4Tenda AX1806 SetRebootTimer formSetRebootTimer stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.07CVE-2024-4239
04/26/20248.88.4Tenda AX1806 SetOnlineDevName formSetDeviceName stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.11CVE-2024-4238
04/26/20248.88.4Tenda AX1806 execCommand R7WebsSecurityHandler stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.11CVE-2024-4237
04/26/20248.88.4Tenda AX1803 SetDDNSCfg formSetSysToolDDNS stack-based overflowUnknownProof-of-ConceptNot Defined0.000451.04CVE-2024-4236
04/25/20248.88.4Tenda W30E WizardHandle fromWizardHandle stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.30CVE-2024-4171
04/25/20248.88.6Tenda 4G300 sub_429A30 stack-based overflowUnknownNot DefinedNot Defined0.000450.18CVE-2024-4170
04/25/20248.88.6Tenda 4G300 sub_4279CC stack-based overflowUnknownNot DefinedNot Defined0.000450.24CVE-2024-4169
04/25/20248.88.6Tenda 4G300 sub_4260F0 stack-based overflowUnknownNot DefinedNot Defined0.000450.32CVE-2024-4168
04/25/20248.88.6Tenda 4G300 sub_422AA4 stack-based overflowUnknownNot DefinedNot Defined0.000450.37CVE-2024-4167
04/25/20248.88.6Tenda 4G300 sub_41E858 stack-based overflowUnknownNot DefinedNot Defined0.000450.37CVE-2024-4166
04/25/20248.88.4Tenda G3 modifyDhcpRule stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.33CVE-2024-4165
04/25/20248.88.4Tenda G3 ModifyPppAuthWhiteMac formModifyPppAuthWhiteMac stack-based overflowUnknownProof-of-ConceptNot Defined0.000450.31CVE-2024-4164
04/24/20248.88.6Tenda W15E guestWifiRuleRefresh stack-based overflowUnknownNot DefinedNot Defined0.000450.18CVE-2024-4127

1047 more entries are not shown

Might our Artificial Intelligence support you?

Check our Alexa App!