Tenda i9 Firmware vulnerabilities

11 CVEs affecting Tenda i9 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-7036, published 2026-04-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-40100, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.
CVE-2024-0996, published 2024-01-29. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Tenda i9 1.0.0.9(4122). This affects the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the…
CVE-2024-11650, published 2024-11-25. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation leads to null pointer…
CVE-2022-40107, published 2022-09-23. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formexeCommand function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2022-40106, published 2022-09-23. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2022-40105, published 2022-09-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2022-40101, published 2022-09-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2022-40104, published 2022-09-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2022-40102, published 2022-09-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
CVE-2026-7036, published 2026-04-26. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was identified in Tenda i9 1.0.0.5(2204). This vulnerability affects the function R7WebsSecurityHandlerfunction of the component HTTP Handler. The manipulation leads to path…

Latest

CVE-2022-40103, published 2022-09-23. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.