Tenda w18e Firmware vulnerabilities

15 CVEs affecting Tenda w18e Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-45343, published 2025-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-46370, published 2023-10-25. Critical severity, CVSS 9.8. EPSS: 18.1% chance of exploitation in the next 30 days. Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.
CVE-2024-46437, published 2025-02-10. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information,…
CVE-2024-46434, published 2025-02-10. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative access by sending a specially crafted HTTP…
CVE-2023-46369, published 2023-10-25. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function.
CVE-2024-46430, published 2025-02-10. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated remote attacker to change the administrator…
CVE-2024-46435, published 2025-02-10. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a denial of service or potentially execute arbitrary code.…
CVE-2025-45343, published 2025-05-28. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmodules route.
CVE-2024-46432, published 2025-02-10. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setQuickCfgWifiAndLogin function, which allows unauthorized…
CVE-2024-46429, published 2025-02-10. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a default guest account with administrative…
CVE-2025-3203, published 2025-04-04. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the…

Latest

CVE-2025-29218, published 2025-03-20. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a…
CVE-2025-29217, published 2025-03-20. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a…
CVE-2024-46436, published 2025-02-10. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service.
CVE-2024-46433, published 2025-02-10. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the default rzadmin account with administrative…