VYPR
advisoryPublished Aug 17, 2026· Updated Aug 18, 2026· 1 source

Tenda Routers: 17 Vulnerabilities Including RCE and Auth Bypass Disclosed Together

Key findings • 17 vulnerabilities disclosed for Tenda devices between August 13-17, 2026. • Critical and High severity flaws allow remote code execution and unauthorized access across multipl…

Key findings

  • 17 vulnerabilities disclosed for Tenda devices between August 13-17, 2026.
  • Critical and High severity flaws allow remote code execution and unauthorized access across multiple models.
  • Buffer overflow vulnerabilities are a common theme, particularly in W20E and httpd components.
  • Publicly disclosed exploits increase the risk of active exploitation for CVE-2026-19924 and CVE-2026-19747.
  • Some vulnerabilities are noted as incomplete fixes for previously disclosed issues.

On August 13-17, 2026, a significant batch of 17 vulnerabilities was disclosed across multiple Tenda router models, with several critical and high-severity flaws potentially allowing remote code execution and unauthorized access. The vulnerabilities affect a range of devices including the Tenda W20E, AC10, AC12, AC1206, G0, and several CH, CP, and TX3 series models. This coordinated disclosure highlights a broad security concern for Tenda device users.

A cluster of vulnerabilities, primarily stack-based buffer overflows, were found in the Tenda W20E models. CVE-2026-19824, CVE-2026-19823, and CVE-2026-19822, all disclosed on August 14th, exploit flaws in functions related to IP/MAC binding, QoS rule deletion, and QoS editing, respectively. These vulnerabilities, rated High (CVSSv3 8.8), allow remote attackers to execute arbitrary code. Additionally, CVE-2026-67967, disclosed on August 17th, is a buffer overflow in the W20E V16.01.0.6(2782) that also permits arbitrary code execution, noted as an incomplete fix for previous vulnerabilities. Another critical vulnerability, CVE-2026-67966, also affecting the W20E V16.01.0.6(2782), allows unauthenticated remote attackers to activate the Telnet daemon and gain root shell access. CVE-2026-67965, impacting the same W20E firmware, allows remote code execution via the url_need_login function.

Several other Tenda models are affected by critical and high-severity flaws. CVE-2026-19747, a critical command injection vulnerability in the ATE module of various CH, CP, and TX3 models, was disclosed on August 13th. On August 16th, CVE-2026-19924, a critical improper authentication vulnerability in the httpd component of the Tenda AC10, was publicly disclosed and may be exploited. High-severity buffer overflow vulnerabilities were also found in the httpd web management interface of Tenda AC12, AC1206, and G0 devices. These include CVE-2026-19821 (AC12), CVE-2026-19789 (AC1206), CVE-2026-19788 (AC1206), CVE-2026-19792 (G0), CVE-2026-19791 (G0), and CVE-2026-19790 (G0), all carrying a CVSSv3 score of 8.8 and allowing remote attackers to execute arbitrary code.

Lower-severity issues were also part of this disclosure. CVE-2026-19750, a critical use of hard-coded password vulnerability affecting Tenda CH, CP, and TX3 models, requires high complexity for remote exploitation. CVE-2026-19749, a low-severity missing authentication flaw in the RTSP/ONVIF component of several CH, CP, and TC models, was disclosed on August 13th. Similarly, CVE-2026-19748, a low-severity insufficient authentication vulnerability in the Kylin Web Service of the same CH, CP, and TC models, was also disclosed on August 13th.

The broad range of affected models and the severity of the vulnerabilities, including remote code execution and authentication bypass, underscore the urgent need for Tenda users to update their devices. While specific patch details for all CVEs are not provided, the disclosure of incomplete fixes for some W20E vulnerabilities suggests that users should prioritize updating to the latest available firmware versions. The public disclosure of exploits for some of these flaws, such as CVE-2026-19924 and CVE-2026-19747, indicates a heightened risk of active exploitation. Users are advised to consult Tenda's official support channels for the most current firmware updates and security advisories.

The batch of vulnerabilities disclosed between August 13th and August 17th, 2026, presents a significant risk to Tenda device owners. The prevalence of buffer overflow and authentication bypass flaws across various product lines necessitates immediate attention from users to mitigate potential security breaches. Staying informed about firmware updates and security recommendations from Tenda is crucial for maintaining the security posture of these network devices.

Key findings include:

  • 17 vulnerabilities disclosed for Tenda devices between August 13-17, 2026.
  • Critical and High severity flaws allow remote code execution and unauthorized access.
  • Multiple Tenda models affected, including W20E, AC10, AC12, AC1206, G0, and CH/CP/TX3 series.
  • Buffer overflow vulnerabilities are a common theme, particularly in W20E and httpd components.
  • Publicly disclosed exploits increase the risk of active exploitation for CVE-2026-19924 and CVE-2026-19747.
  • Some vulnerabilities are noted as incomplete fixes for previously disclosed issues.
  • Low-severity flaws include missing and insufficient authentication issues.
  • Affected firmware versions vary, with some issues present in older releases up to 20260625.
Synthesized by Vypr AI