Tenda flaws being used in attacks
CISA lists 3 flaws in Tenda products as being used in attacks, most recently on 3 Nov 2021.
TendaBeing used in attacks
- On CISA’s list
- 3 flaws, added between 3 Nov 2021 and 3 Nov 2021
- Most recent
- CVE-2021-31755, Tenda AC11 Router Stack Buffer Overflow Vulnerability, added 3 Nov 2021
- Used in ransomware
- None known to CISA
- Products
- AC11 Router (1), AC1900 Router AC15 Model (1), AC7, AC9, and AC10 Routers (1)
What to do
- Update every Tenda product you use.Install the updates Tenda offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Tenda AC11 Router
CVE-2021-31755Tenda AC11 Router Stack Buffer Overflow VulnerabilityTenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.CISA’s required actionApply updates per vendor instructions. - Tenda AC1900 Router AC15 Model
CVE-2020-10987Tenda AC1900 Router AC15 Model Remote Code Execution VulnerabilityTenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.CISA’s required actionApply updates per vendor instructions. - Tenda AC7, AC9, and AC10 Routers
CVE-2018-14558Tenda AC7, AC9, and AC10 Routers Command Injection VulnerabilityTenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Tenda on CISA’s site.