Tenda a18 Firmware vulnerabilities

11 CVEs affecting Tenda a18 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2930, published 2026-02-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-0848, published 2025-01-30. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST…
CVE-2026-2877, published 2026-02-21. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument…
CVE-2026-2876, published 2026-02-21. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes…
CVE-2022-44931, published 2022-12-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
CVE-2023-39829, published 2023-08-14. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the wpapsk_crypto2_4g parameter in the fromSetWirelessRepeat function.
CVE-2023-39828, published 2023-08-14. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
CVE-2023-39827, published 2023-08-14. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function.
CVE-2022-44932, published 2022-12-08. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
CVE-2023-50585, published 2024-01-09. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
CVE-2024-32305, published 2024-04-17. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda A18 v15.03.05.05 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.

Latest

CVE-2026-2930, published 2026-02-22. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of…