Tenda 4g300 Firmware vulnerabilities

12 CVEs affecting Tenda 4g300 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-7470, published 2026-04-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-7469, published 2026-04-30. Medium severity, CVSS 6.3. EPSS: 3.2% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation of the argument delflag results in…
CVE-2024-4167, published 2024-04-25. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical. Affected by this issue is the function sub_422AA4. The manipulation of the argument year/month/day/hour/minute/second…
CVE-2024-4169, published 2024-04-25. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4279CC. The manipulation of the argument page leads to…
CVE-2024-4168, published 2024-04-25. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation of the argument upfilen leads to stack-based buffer…
CVE-2024-4166, published 2024-04-25. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical. Affected by this vulnerability is the function sub_41E858. The manipulation of the argument GO/page leads to…
CVE-2024-4170, published 2024-04-25. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda 4G300 1.01.42. It has been rated as critical. This issue affects the function sub_429A30. The manipulation of the argument list1 leads to stack-based buffer…
CVE-2026-7470, published 2026-04-30. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilter. This manipulation of the argument page causes stack-based…
CVE-2023-37723, published 2023-07-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromqossetting.
CVE-2023-37722, published 2023-07-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeUrlFilter.
CVE-2023-37721, published 2023-07-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeMacFilter.

Latest

CVE-2023-38929, published 2023-08-07. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda 4G300 v1.01.42 was discovered to contain a stack overflow via the page parameter at /VirtualSer.