What’s Vulnerable › Products

Tenda AC9 vulnerabilities

94 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 28 published in the last 12 months.

Check whether your Tenda AC9 version is affected

Exploited Tenda AC9 vulnerabilities

• CVE-2018-14558 — Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Latest Tenda AC9 vulnerabilities

• CVE-2026-104611 — Tenda AC9 POST Request fast_setting_internet_set stack-based overflow (CVSS 9.1)
• CVE-2026-86300 — Tenda AC9 Web Management R7WebsSecurityHandler improper authentication (CVSS 7.3)
• CVE-2026-6016 — Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow (CVSS 8.8)
• CVE-2026-6015 — Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow (CVSS 8.8)
• CVE-2026-2192 — Tenda AC9 formGetRebootTimer stack-based overflow (CVSS 7.2)
• CVE-2026-2191 — Tenda AC9 formGetDdosDefenceList stack-based overflow (CVSS 7.2)
• CVE-2025-14286 — Tenda AC9 Configuration File DownloadCfg.jpg information disclosure (CVSS 7.5)
• CVE-2025-57638 — (CVSS 7.5)
• CVE-2025-57639 — (CVSS 6.5)
• CVE-2025-10443 — Tenda AC9/AC15 exeCommand formexeCommand buffer overflow (CVSS 8.8)
• CVE-2025-10442 — Tenda AC9/AC15 exeCommand formexeCommand os command injection (CVSS 8.8)
• CVE-2025-9731 — Tenda AC9 Administrative shadow hard-coded credentials (CVSS 7.0)
• CVE-2025-5900 — Tenda AC9 cross-site request forgery (CVSS 7.1)
• CVE-2025-5847 — Tenda AC9 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow (CVSS 8.8)
• CVE-2025-5839 — Tenda AC9 POST Request AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.8)
• CVE-2025-5836 — Tenda AC9 POST Request SetIPTVCfg formSetIptv command injection (CVSS 6.3)
• CVE-2025-45042 — (CVSS 9.8)
• CVE-2025-44877 — (CVSS 9.8)
• CVE-2025-44872 — (CVSS 9.8)
• CVE-2025-45429 — (CVSS 9.8)
• CVE-2025-45428 — (CVSS 9.8)
• CVE-2025-45427 — (CVSS 9.8)
• CVE-2025-29387 — (CVSS 7.1)
• CVE-2025-29386 — (CVSS 9.8)
• CVE-2025-29385 — (CVSS 9.8)