Tenda m3 Firmware vulnerabilities

45 CVEs affecting Tenda m3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-5567, published 2026-04-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-32035, published 2022-07-01. High severity, CVSS 7.5. EPSS: 14.8% chance of exploitation in the next 30 days. Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng.
CVE-2023-51092, published 2023-12-26. Critical severity, CVSS 9.8. EPSS: 12.9% chance of exploitation in the next 30 days. Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.
CVE-2023-51091, published 2023-12-26. Critical severity, CVSS 9.8. EPSS: 8.5% chance of exploitation in the next 30 days. Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.
CVE-2025-9299, published 2025-08-21. Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The…
CVE-2025-15252, published 2025-12-30. High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days. A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument…
CVE-2025-15234, published 2025-12-30. High severity, CVSS 8.8. EPSS: 2.9% chance of exploitation in the next 30 days. A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This manipulation of the argument…
CVE-2022-27083, published 2022-03-24. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.
CVE-2022-27082, published 2022-03-24. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.
CVE-2022-27081, published 2022-03-24. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.
CVE-2022-27080, published 2022-03-24. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.

Latest

CVE-2026-5567, published 2026-04-05. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw has been found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Destination Handler. Executing a…
CVE-2025-15253, published 2025-12-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to stack-based…
CVE-2025-15233, published 2025-12-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The manipulation of the argument…
CVE-2025-15232, published 2025-12-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal…
CVE-2025-15231, published 2025-12-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipulation of the argument ID/vlan/port can…
CVE-2025-15230, published 2025-12-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performing a manipulation of the argument…
CVE-2025-9298, published 2025-08-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer…