Tenda TX3 Firmware vulnerabilities

14 CVEs affecting Tenda TX3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2137, published 2026-02-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-40942, published 2022-09-28. Critical severity, CVSS 9.8. EPSS: 8.5% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
CVE-2025-1897, published 2025-03-04. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /goform/SetNetControlList. The manipulation of…
CVE-2022-43029, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
CVE-2022-43028, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
CVE-2022-43027, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
CVE-2022-43026, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg.
CVE-2022-43025, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServerCfg.
CVE-2022-43024, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
CVE-2025-1895, published 2025-03-04. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList…
CVE-2025-1898, published 2025-03-04. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Tenda TX3 16.03.13.11_multi. Affected is an unknown function of the file /goform/openSchedWifi. The manipulation of the argument…

Latest

CVE-2026-2137, published 2026-02-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow.…
CVE-2025-8958, published 2025-08-14. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set. The manipulation of the…
CVE-2025-1899, published 2025-03-04. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setPptpUserList. The…
CVE-2025-1896, published 2025-03-04. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg. The manipulation of the argument list…