Tenda w15e Firmware vulnerabilities

31 CVEs affecting Tenda w15e Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-30140, published 2026-03-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-40843, published 2022-11-15. Medium severity, CVSS 4.9. EPSS: 28.8% chance of exploitation in the next 30 days. The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated…
CVE-2017-14514, published 2017-09-17. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL.
CVE-2024-4127, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the argument qosGuestDownstream leads to…
CVE-2024-4126, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument…
CVE-2024-4125, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. This vulnerability affects the function formSetStaticRoute of the file /goform/setStaticRoute. The manipulation of…
CVE-2024-4124, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the…
CVE-2024-4123, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The…
CVE-2024-4122, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Tenda W15E 15.11.0.14. Affected by this vulnerability is the function formSetDebugCfg of the file /goform/setDebugCfg. The manipulation of the…
CVE-2024-4121, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14. Affected is the function formQOSRuleDel. The manipulation of the argument qosIndex leads to stack-based buffer…
CVE-2024-4120, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda W15E 15.11.0.14. It has been rated as critical. This issue affects the function formIPMacBindModify of the file /goform/modifyIpMacBind. The manipulation of the…

Latest

CVE-2026-30140, published 2026-03-09. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg endpoint to download the configuration…
CVE-2024-4119, published 2024-04-24. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Tenda W15E 15.11.0.14. It has been declared as critical. This vulnerability affects the function formIPMacBindDel of the file /goform/delIpMacBind. The manipulation of…