Tenda a15 Firmware vulnerabilities

22 CVEs affecting Tenda a15 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-4567, published 2026-03-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-4897, published 2025-05-18. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/multimodalAdd of the component HTTP POST Request…
CVE-2024-0532, published 2024-01-15. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based…
CVE-2024-0533, published 2024-01-15. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.13. It has been rated as critical. This issue affects some unknown processing of the file /goform/SetOnlineDevName of the component Web-based…
CVE-2024-0534, published 2024-01-15. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Tenda A15 15.13.07.13. Affected is an unknown function of the file /goform/SetOnlineDevName of the component Web-based Management Interface.…
CVE-2024-0531, published 2024-01-15. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/setBlackRule of the component Web-based Management Interface.…
CVE-2026-4567, published 2026-03-23. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based…
CVE-2022-47128, published 2022-12-30. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.
CVE-2022-47123, published 2022-12-30. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet.
CVE-2022-47127, published 2022-12-30. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.
CVE-2022-47126, published 2022-12-30. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.

Latest

CVE-2025-12619, published 2025-11-03. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of the argument wpapsk_crypto2_4g results…
CVE-2025-4867, published 2025-05-18. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function formArpNerworkSet of the file /goform/ArpNerworkSet. The…