Tenda i12 Firmware vulnerabilities
9 CVEs affecting Tenda i12 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-5849, published 2026-04-09.
More from Tenda.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2026-4042, published 2026-03-12. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A weakness has been identified in Tenda i12 1.0.0.6(2204). The affected element is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. This manipulation of the argument index…
- CVE-2026-4043, published 2026-03-12. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A security vulnerability has been detected in Tenda i12 1.0.0.6(2204). The impacted element is the function formwrlSSIDget of the file /goform/wifiSSIDget. Such manipulation of the argument index…
- CVE-2026-4041, published 2026-03-12. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A security flaw has been discovered in Tenda i12 1.0.0.6(2204). Impacted is the function vos_strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput results in stack-based…
- CVE-2026-5609, published 2026-04-06. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw has been found in Tenda i12 1.0.0.11(3862). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset of the component Parameter Handler. This manipulation…
- CVE-2026-5849, published 2026-04-09. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack…
- CVE-2025-29149, published 2025-03-20. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
- CVE-2025-25678, published 2025-02-20. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- CVE-2025-25676, published 2025-02-20. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- CVE-2025-25679, published 2025-02-20. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.