Tenda AX12 Firmware vulnerabilities

31 CVEs affecting Tenda AX12 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-29215, published 2025-03-20.

More from Tenda.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-45392, published 2022-02-14. High severity, CVSS 7.5. EPSS: 12.3% chance of exploitation in the next 30 days. A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service.
• CVE-2022-28561, published 2022-05-03. Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days. There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router. An attacker can obtain a stable shell through a carefully…
• CVE-2022-28917, published 2022-05-18. High severity, CVSS 7.5. EPSS: 9.6% chance of exploitation in the next 30 days. Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.
• CVE-2022-28082, published 2022-05-04. Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days. Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList.
• CVE-2022-45980, published 2022-12-12. High severity, CVSS 8.8. EPSS: 7.5% chance of exploitation in the next 30 days. Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .
• CVE-2023-49428, published 2023-12-07. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
• CVE-2023-49437, published 2023-12-07. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
• CVE-2022-45043, published 2022-12-12. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
• CVE-2022-45977, published 2022-12-12. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
• CVE-2021-45391, published 2022-02-16. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes…

Latest

• CVE-2025-29215, published 2025-03-20. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.
• CVE-2025-29214, published 2025-03-20. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.
• CVE-2024-39963, published 2024-07-19. High severity, CVSS 8.0. EPSS: 1.5% chance of exploitation in the next 30 days. AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE)…
• CVE-2024-40503, published 2024-07-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.
• CVE-2024-40412, published 2024-07-10. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.
• CVE-2024-28383, published 2024-03-14. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.
• CVE-2023-47422, published 2024-02-20. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication…
• CVE-2023-49427, published 2024-01-10. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.