Tenda AC1206 Firmware vulnerabilities

44 CVEs affecting Tenda AC1206 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0581, published 2026-01-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-9793, published 2024-10-10. Critical severity, CVSS 9.8. EPSS: 23.1% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation…
CVE-2026-0581, published 2026-01-05. Critical severity, CVSS 9.8. EPSS: 9.4% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. Executing a…
CVE-2025-3328, published 2025-04-07. High severity, CVSS 8.8. EPSS: 7.6% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The…
CVE-2022-37810, published 2022-08-25. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.
CVE-2025-7544, published 2025-07-13. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the…
CVE-2025-10432, published 2025-09-15. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 15.03.06.23. This vulnerability affects the function check_param_changed of the file /goform/AdvSetMacMtuWa of the component HTTP Request Handler. Performing…
CVE-2024-10434, published 2024-10-28. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 up to 20241027. It has been classified as critical. This affects the function ate_Tenda_mfg_check_usb/ate_Tenda_mfg_check_usb3 of the file /goform/ate. The…
CVE-2022-37816, published 2022-08-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetIpMacBind.
CVE-2022-37815, published 2022-08-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the PPPOEPassword parameter in the function formQuickIndex.
CVE-2022-37814, published 2022-08-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parameters in the function addWifiMacFilter.

Latest

CVE-2025-9523, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in…
CVE-2025-4299, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation leads to…
CVE-2025-4298, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm. The manipulation leads to…
CVE-2024-10280, published 2024-10-23. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the…